{ "Event": { "published": true, "date": "2023-11-09", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-11-09", "timestamp": 1699574581, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "9657410e-b309-4dd0-b7e2-45d586f91f19", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec9a9010-7ef2-11ee-8907-42010a9c0042", "comment": "Malware payload (AsyncRAT)", "timestamp": 1699529231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699529231, "uuid": "cefe71c6-0071-49f3-918e-3038da9bc147", "comment": "Malware payload (AsyncRAT)", "value": "9bf643af1efb2fc76bf929b7abb788f2", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699529231, "uuid": "59c976e3-1264-4ed7-8111-54979835c3a7", "comment": "Malware payload (AsyncRAT)", "value": "0248a7d6b6e9c7623e9bc5023a76b424e79236b75cc7516e0195874bd28b42ae", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699529231, "uuid": "b1487de2-6193-4eff-aaf2-9abb1616da2d", "comment": "Malware payload (AsyncRAT)", "value": "90ad3ea76b5260f016aceb6fdc6717331c8c6092", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699529231, "uuid": "d5470739-60cd-4366-bfdd-e8fb1f342391", "comment": "Malware payload (AsyncRAT)", "value": "2592e7982def07b87e9ee6c16c909de7a3fe0570109f161f73bf978d769d9539c98654a3e111f17d2048d1d1b6532673", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699529231, "uuid": "abc1026e-a87b-4efd-bf6d-1b3868044d6e", "value": "T15E334D0077E9812AF2BE4F7458F22245867BF1673923D55E1CCC019B5B13BC69642BFA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699529231, "uuid": "29f1e123-717b-484f-9919-8fe2c4a28105", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699529231, "uuid": "b517a9ff-291e-4a16-9fac-e5218d1ea10c", "value": "1536:4uSNpskTAEp2I2j7C5Zgb7Y/Pb74ptfrMcbvUFhdwf0o:4u6ikTAEp2I2j7C5Gb7Y/Pb7YtfrMgvf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699529231, "uuid": "66ed34f8-e082-4bb0-8fc3-8e7f2c1a033d", "value": 53760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699529231, "uuid": "b3cd3e73-21db-4089-babc-332919430e71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699529231, "uuid": "2a86d1fb-a25e-4dd7-815b-24dac64b6f5e", "value": "0248a7d6b6e9c7623e9bc5023a76b424e79236b75cc7516e0195874bd28b42ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad26f535-7f23-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699550170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699550170, "uuid": "b13a7e56-b5cb-4219-9fe6-9fbdbfece23b", "comment": "Malware payload", "value": "ea40ebf06506ca71818af2e0ea80a10d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699550170, "uuid": "9b34114c-1d3c-4a36-805f-cb66ff40c89f", "comment": "Malware payload", "value": "02676794da0a8987caf3ba74d124853102b1143741f18edf6f6a7bc7776e452c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699550170, "uuid": "8e57c505-9b9e-44da-bf87-6766dc4ece84", "comment": "Malware payload", "value": "c0ba9c94ebbda65c09cff737a11caf2cff506ada", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699550170, "uuid": "d3efbfed-1bdf-41f3-9a45-c892b5a1dea9", "comment": "Malware payload", "value": "57c64a0f88cb0e8d34eaf6b76d28ece4621c45a1a35e34d199dde12f744f807faae141846daae09fc7cf7997d7969288", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699550170, "uuid": "e3739c99-ff71-4128-afe5-4fbed7ea828d", "value": "T1FE04D707B68B8AB5CB496B3EC7FB16040374D2826293E72A79CE2FE5180377B5D0154B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699550170, "uuid": "70921473-6099-4030-b2e6-24188630302a", "value": "3072:zbHGfhXdTzIhcqk9kX9bkbTPaFG2Rzkfu9Hk2cX2:zKrTNI9bkbTPb2duu9E/X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699550170, "uuid": "8dc513cf-2d07-40cc-8dc0-e1cd49529d16", "value": 188928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699550170, "uuid": "74c7c259-974a-4bb3-9260-242282f3ccb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699550170, "uuid": "022f80b0-473b-42cd-a2cf-9bddff69ce34", "value": "SecuriteInfo.com.Win64.TrojanX-gen.23536.335", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eb7234d-7ecd-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699513074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513074, "uuid": "3d09f3c1-8767-420a-8c9d-4139afea5d5e", "comment": "Malware payload", "value": "b4223422ace7a2963199af04464067ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513074, "uuid": "918c3f56-2b2d-4e58-82cd-797d624dba4b", "comment": "Malware payload", "value": "04bce34a237f0ad04d1dca7d7c5b8f66faca166e5537c2357bb7fe8201656371", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513074, "uuid": "2a40054e-b9c2-4c10-a3e9-db596b57285d", "comment": "Malware payload", "value": "d4dd69acf701c720e7d431960907423e96dc15a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513074, "uuid": "0530cd9c-371c-4276-a41a-a9b089222e13", "comment": "Malware payload", "value": "3a0117e0abc2dc1355927ba7a43d0d196020a8a7fe72c4ab300dc92300568631d3af8ab87ab8a3bdc5c31aa2dca177ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513074, "uuid": "a0c95fba-e1d5-43be-bbcb-1b09b360111a", "value": "T10B635A1CA78CE952C29C187D85E3912543FDE1B32602F30B5EC5A6A96D437E1462AFF3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513074, "uuid": "8f49b8e3-164f-4274-9262-4bd79674f822", "value": "1536:i8zjFDkgD7ACV9MAG+sBhRDSwriLh5DEARnjJzDLnvvJY:i8vFDkgDZuABkrSXLhznjtPnXJY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699513074, "uuid": "1a7ae9cf-58e1-405e-a99a-409b3a8be873", "value": 68608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699513074, "uuid": "944b2ffc-183e-475a-b147-dcde5ad8f2f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513074, "uuid": "34bb4df7-6496-4bfd-9237-0a7a15f69ef0", "value": "Payment Enquiries.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75bd43e3-7f4c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699567686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699567686, "uuid": "a71d9d52-0f88-4594-a281-2e80d20b0f0f", "comment": "Malware payload", "value": "531bd1aea79e58774f044ce5ad2d0c34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699567686, "uuid": "c9704c81-697b-41a4-9ec5-20a13a5f3eef", "comment": "Malware payload", "value": "068a1d73bb6575fec8c10ad1d7623c547e49e26629d0f4e0da7f6309b4489d7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699567686, "uuid": "5d174ce2-a3d5-4ecb-9ba4-7e5b5b6c937f", "comment": "Malware payload", "value": "b1ccb80972427b00d8182a4d95fdfe03d425ec4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699567686, "uuid": "10f1912c-cfb9-4f7f-8fe9-096e221f62aa", "comment": "Malware payload", "value": "3735281b34e88fc1cbdbb3fa5d72dbdd43f10cf2e2c52aab005a783aa7aceafc26a6b96143d490cae0746abf0820061c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699567686, "uuid": "422c0e0d-6681-4704-9110-2a598356c11d", "value": "T19AB41256AAD84072FDB077706CF606D30F36BC659978836B2285A96B0CB3AC4D536337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699567686, "uuid": "190dda0a-5476-44cf-a5a8-8eaa2d178be7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699567686, "uuid": "9668e17e-89e0-4095-8648-57bf03b809ce", "value": "12288:kMrpy90yDq7wGSWD3tW3Bp8fU+sbY8TUs2luE+4+wSRXFD+8eaJF4Jg:Fynq8ADyUcPYSz2lurUSldFUg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699567686, "uuid": "0d1b758b-51aa-4be2-8a3d-667bef201c67", "value": 523776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699567686, "uuid": "1e849792-eee4-4a45-b1a4-a9bb0065c99d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699567686, "uuid": "73ff7aff-3888-438d-82cf-038eb462cbb0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b061168f-7efc-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1699533425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699533425, "uuid": "d82bdab8-ad19-4535-8e3b-b3e2d0100184", "comment": "Malware payload (SnakeKeylogger)", "value": "cb1d86841c8f922f3a4106b0dba1b144", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699533425, "uuid": "bffa3f76-62b8-42b5-9028-3656c4042872", "comment": "Malware payload (SnakeKeylogger)", "value": "06ecf916b6e3d161ee0614ac558477f56b8f9212fc41bf00234ff62b15b86027", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699533425, "uuid": "0a63d2f9-8d8c-4861-a5dc-1ba93ad56322", "comment": "Malware payload (SnakeKeylogger)", "value": "8eacdefdb557684ca8e9204621e7459d339d8f28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699533425, "uuid": "7a1d974f-49ee-4f7d-b949-a4b9835c4131", "comment": "Malware payload (SnakeKeylogger)", "value": "e5266efce631c93d2109015a93a727c3e12ed5da10eb01156fb5823a9f9de5abf3134f89308d092b96320dcb75937cf4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699533425, "uuid": "58383cfe-cb5e-4b11-9bd4-4b4db2266c38", "value": "T1BEC3191C67F89800F6FF897701725111C775FD52092ADE0E5AD0F86A2ABDA908D1AFE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699533425, "uuid": "7b8a566c-822f-461e-9fda-4877e94b407e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699533425, "uuid": "c7fc36c1-ac1b-45e6-97c4-3c3f0bf37b36", "value": "3072:Ww1/isKYBIkBGiKupMnmb7fDf7gHwBkxSgbY:Ziy3T0mbjD8xbb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699533425, "uuid": "15c1ba15-e170-4f65-a732-45eaec779f0b", "value": 126464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699533425, "uuid": "97d8f54d-4113-4798-aff1-7cb9e7068a49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699533425, "uuid": "db1ea437-ef26-47a5-a4e0-c689a0651566", "value": "06ecf916b6e3d161ee0614ac558477f56b8f9212fc41bf00234ff62b15b86027", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b802e5b-7ed7-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699517257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699517257, "uuid": "999fa061-ef09-456a-b4af-fb2a9dd73ea0", "comment": "Malware payload (AgentTesla)", "value": "6e29849e183af76ab02f23a723b28644", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699517257, "uuid": "8abfede6-ecf9-4db8-ab30-4ff86a76b7c7", "comment": "Malware payload (AgentTesla)", "value": "08dee64a7678819af1f98d97c614dc08afd87d2964497cb6f9a5c917a075f534", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699517257, "uuid": "d283f591-1397-44bb-8652-e9381a9cdfbd", "comment": "Malware payload (AgentTesla)", "value": "346f109cab4db0777bf04bc200c4672834dc6c24", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699517257, "uuid": "cacd4f11-bb44-4429-be99-6deb719cf83a", "comment": "Malware payload (AgentTesla)", "value": "98950fa0830bb04bc22a404cac91bdc5dbf17df27c8db447a47f03aca2ba29a6a4fe24afea8b744469321916062c28b5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699517257, "uuid": "4b3e5083-aa21-4684-a10c-453a3aa633d9", "value": "T1C415F145724948F0CC7DD3339222E1538D2DAFE96BE0D66E10C277E96B7364D8ACA613", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699517257, "uuid": "e098b758-cb9b-4ee7-b3c8-0c3fb937499d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699517257, "uuid": "729d37f0-4b10-4458-989a-1a4230b3699d", "value": "12288:IlbufjVpNKUF3OjhlYnf8KPGNaTp7WdrhatiKu8maaWD/CHWKgOxwr:isGQOjhlYUUGkp7Y8laWD/1K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699517257, "uuid": "59f2a7b8-4cc4-4e85-ab73-9b05205d3780", "value": 928768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699517257, "uuid": "4c3a7e91-0914-4173-a31a-a5fc0b7f01e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699517257, "uuid": "ae83dd33-7022-4bbb-ba6d-5127ce96b7f8", "value": "6e29849e183af76ab02f23a723b28644", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5063aa95-7ef6-11ee-8907-42010a9c0042", "comment": "Malware payload (CobaltStrike)", "timestamp": 1699530687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699530687, "uuid": "6be1e8a4-5de6-4d26-a5cf-b8bdf971e109", "comment": "Malware payload (CobaltStrike)", "value": "6752bf722cac1f728e54d455e1702364", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699530687, "uuid": "ef0c6a99-fb41-48b2-b85a-3e4e0211621e", "comment": "Malware payload (CobaltStrike)", "value": "08efec5f18d1eb8394bb92240d4d25a1444295a0c011c9d99db58c17d582a618", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699530687, "uuid": "c4b5ac01-7985-4eec-8aab-2def674a26ad", "comment": "Malware payload (CobaltStrike)", "value": "0ceecd42ed80027ecb87a7bda415f9e97309b02f", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699530687, "uuid": "f6de00f1-4049-4b00-8bef-7960124ddf69", "comment": "Malware payload (CobaltStrike)", "value": "df978f16ee0db7df31d0b24a27b41a9f7e656f7bf79faede673c3f4fd072d120aec23c758d9342199370db782d45b248", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699530687, "uuid": "949b94dc-e3ae-4951-936b-af7fbd4eb0c1", "value": "T1A482E93FB24264AACA3BD038C8D66776ADF7B123102B171E1AB4CB312F20DB8553D915", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699530687, "uuid": "7994f7fb-042a-4a54-9136-37ec45a75e2b", "value": "bed5688a4a2b5ea6984115b458755e90", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699530687, "uuid": "8d9163b3-aa31-47af-946c-a90200fe819e", "value": "384:160rg4v9kEZuv8qTG94H/FUGyMd6KuY6Y97wFwP:1xMpEoZTAy/GJ0SFMKC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699530687, "uuid": "3f075e86-c577-44b4-90ed-2cc90c5ebe41", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699530687, "uuid": "c08dbae6-db00-4c81-b38f-7953b61f7ed5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699530687, "uuid": "68632a06-333d-4077-8edd-d50c06b585f0", "value": "08efec5f18d1eb8394bb92240d4d25a1444295a0c011c9d99db58c17d582a618", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f007c634-7ecd-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699513345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513345, "uuid": "314a9578-1d15-43a8-98ee-c818003efb72", "comment": "Malware payload (AgentTesla)", "value": "002d33ff0139eb77dbb572c874a3dcbd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513345, "uuid": "bff60589-c1a9-4c0a-9bac-229f72e7d209", "comment": "Malware payload (AgentTesla)", "value": "093ed666582935d5b1169c0f512fd4194572b1dc0147d8ccf2a6d90893db23bb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513345, "uuid": "74b3a503-23ec-402e-a06b-0c21a8495b76", "comment": "Malware payload (AgentTesla)", "value": "9f3211f20be4398c205d7b14af98120b0bb08fe6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513345, "uuid": "32857025-ab3f-4913-ab10-08258090be19", "comment": "Malware payload (AgentTesla)", "value": "9c2d5b72a1ceea14bff70318f4cec79bf1768aac9990a12c3ac48c30881ed9d60a81ab22a23b4d8d0a3fba3012aeb9b9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513345, "uuid": "f950f19e-6bf9-458f-a41f-4a81d2700b3b", "value": "T1BF258B043BB94163D95DC63690E3194197B3CC5667CAAB0A2C85B7B84A7337DEF0B287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513345, "uuid": "cc0278ea-fb1b-4614-b4ae-c8ac19a58d0d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513345, "uuid": "8b4f58a7-719d-48f6-a872-32588dc51e93", "value": "12288:kEZyjXQ9V0HLamLfHURe5WtnkLXFEOepGaAwVXGYe/8AK:cXQ9V0nf5Y09epdAsVe/1K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699513345, "uuid": "fa43f56f-827b-4312-9cbf-c89154675aba", "value": 1001424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699513345, "uuid": "108c6fc9-e063-40d2-977f-1e1d7318697b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513345, "uuid": "e65981f4-0305-424f-8f58-0c15dcb9c703", "value": "QUOTATION_OCT9FIBA00541\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c42a9fe-7f48-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699566006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699566006, "uuid": "abb8fcc7-618a-4e30-8f98-9e35f9e8e0cc", "comment": "Malware payload (RedLineStealer)", "value": "4935c6480c5631dcdf82d0c4d977a003", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699566006, "uuid": "70503747-e9d2-4a3d-9412-3fd1277b612f", "comment": "Malware payload (RedLineStealer)", "value": "0b0aa624ef09f720ef3757abc35c0c1d0fbd24e9a77500132f5d89d99e9f1164", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699566006, "uuid": "b54cf238-adc2-4488-924d-a7a9b7c6e0a5", "comment": "Malware payload (RedLineStealer)", "value": "064bf5059b728572e0772be8babec625a98ac7e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699566006, "uuid": "7a7c2f9e-3f6b-4860-bfa1-8327d763bb7f", "comment": "Malware payload (RedLineStealer)", "value": "60b5b3d3d7751ff8205b037912a80fb223d0558816d85a44d954aee1945dd3a920f20c79a7c69a45e845c2b57ceee32b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699566006, "uuid": "61f1d393-883d-45d4-986c-672bbdca3b85", "value": "T1FDB40243E7E84072EE755BB068FA06830E767CB18978935B3285A81F1C737C4A97572B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699566006, "uuid": "28f447c6-a0d7-4196-9bc1-20b914b19d58", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699566006, "uuid": "f56a660f-0508-45af-aae4-46be93169155", "value": "12288:IMr8y90nvhHGe8Mb+EylwXSM8LbY8TUs2Yur+4+wSRIF2/+jjg+HE+:UyyGZMyOS1bYSz2YuCUS+cuU+k+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699566006, "uuid": "59e15353-fa69-4b9e-94de-1645245d04c3", "value": 523264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699566006, "uuid": "3e775c1d-a642-4c58-9034-83d259047930", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699566006, "uuid": "a48c8b21-9e62-4875-b6d5-ed0d5ec68821", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdef01b3-7ecc-11ee-8907-42010a9c0042", "comment": "Malware payload (PureCrypter)", "timestamp": 1699512939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512939, "uuid": "162f127f-66eb-4bfc-9b61-2265ca6674c8", "comment": "Malware payload (PureCrypter)", "value": "b8f326ed6d4d36f2a04c1e87cc328f9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512939, "uuid": "4e1aaa6b-9db0-43ba-b7cf-41fdb82bd87b", "comment": "Malware payload (PureCrypter)", "value": "0c01a6439551142220d34d8abd3a8d453ce3078b9ea3f53eb747c50715768df7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512939, "uuid": "45753235-1e50-4e9a-8891-44434c6af537", "comment": "Malware payload (PureCrypter)", "value": "e9561665ce9164713f4fdaa4e3fbb89d315af37a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512939, "uuid": "a822f223-65de-4269-9da4-0c390265f2e9", "comment": "Malware payload (PureCrypter)", "value": "665859910a514893356faa4fe69ab61284a52757ece868c9c3485451786e26f509fb243f9221dd5cdc54f65b10574643", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512939, "uuid": "58b82898-64f1-43d4-b289-b4748f3e1b12", "value": "T13F5219809B6CD5A3D96B17FD5DB787122A29F652A805DF1B74CD730B3D03602283A717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512939, "uuid": "f436490b-fb0e-4c99-b2c0-f195767b5b2f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512939, "uuid": "fe2ec2d7-adaa-4409-a836-fff5a79bb1b8", "value": "384:xZMyMyn38Rg5y9Ako3eZiiay9ycyrsR2vZ8:xOyR52AkocycyrsR2vZ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699512939, "uuid": "13fc1a70-72da-45c1-b423-c8a411fd87bf", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699512939, "uuid": "93812748-4a25-4b65-9165-4ad511b7424c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512939, "uuid": "8c5027e8-85c3-4653-ad03-4e645bc72e84", "value": "Galvanized Sheet Technical Specification.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d3e8b34-7f14-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1699543513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699543513, "uuid": "62bbce51-9a38-4e8f-a0a9-03fceab2c513", "comment": "Malware payload (Stealc)", "value": "b26b3e80af93b28e56f2d70b2f982036", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699543513, "uuid": "775e01ac-4c7d-4bb8-b282-8bdab63b8f30", "comment": "Malware payload (Stealc)", "value": "0c1d0623d5b235fe8bd4e4ab99c97b276d30874e7515c91794bb1be10a6a8c27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699543513, "uuid": "ade27ae7-888c-45f9-9d08-81eca91e9ddf", "comment": "Malware payload (Stealc)", "value": "7fdbdc4728ddd97eaab90ef0217cba5bb9f7bef5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699543513, "uuid": "38ab0112-d812-4dbd-86ec-60e554679274", "comment": "Malware payload (Stealc)", "value": "f9e9b1ec6624de5ebf2b992f1001333042ece19ec50cb3949956f1525c7293b2c02d442957b8b940e0dfb8b575f77681", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699543513, "uuid": "9952fb3a-7d11-49fb-9e95-f36396f5c7f5", "value": "T13306DF267B55D954D26A6636C6E7001903B3D9CB3322FA0B3EDA538A29037DF0CC9D9D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699543513, "uuid": "1d729328-9263-4913-9fdc-9395ef0ad14d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699543513, "uuid": "0f5b28b6-9d49-4ef1-baa5-153898f9a506", "value": "49152:BY9o5F4N2uK6/m2oDociIoOaas3VD1FftHleWgnK16V/vTaT8klQm+EXPWiAPn/:C9o7O2uDm+O0F5Ff71wK6VHOIUQS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699543513, "uuid": "4baf41fd-6d44-4934-a458-10dec7e58505", "value": 3656752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699543513, "uuid": "59192938-a756-42fb-b125-0e640385862e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699543513, "uuid": "4a7c3214-3fde-4cbf-8993-ba0996b4dcfd", "value": "b26b3e80af93b28e56f2d70b2f982036.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28561725-7ed0-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699514299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699514299, "uuid": "4506ce28-940c-4994-bd6f-acaab4ca85ce", "comment": "Malware payload (AgentTesla)", "value": "049b407f81af270d202a7b448ab69d49", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699514299, "uuid": "7e93033f-a56a-47ce-9670-350dc24e2537", "comment": "Malware payload (AgentTesla)", "value": "0c39aea36255e3df8b2580dc6c989602c35f67008fc69b929fec825827348b6e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699514299, "uuid": "86b8db12-9c5c-40db-a2b0-18551fd6196f", "comment": "Malware payload (AgentTesla)", "value": "7ccfc680946daa937893e1ef54d39cf426322a23", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699514299, "uuid": "5ee20bb6-1f0f-4449-bf17-b20fe5450bd2", "comment": "Malware payload (AgentTesla)", "value": "828545c3245781e6ebb7bb8091a8f2070dcab284925387fc4f26970e9a76157b0e800611e423b96aa0b36e1be867e148", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699514299, "uuid": "d57a2ce8-4210-4079-876a-36922910236d", "value": "T1A0045B2067FA610CB2F36F461EF6B5E58F6BB6612A35915E104C160B4BB3D40CEA1B73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699514299, "uuid": "fdf31693-e6a3-4d0e-ad34-e36ad3bb091f", "value": "1536:+gm4STQ8C3ReeeeeHeeeeeTeeeeereeeeeUeeeeeHeeeeeNeeeeeJeeeeekeeeec:7mRQp3J09ZdSKBfOG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699514299, "uuid": "e7eba82b-802b-48bf-9392-b12a5efb465a", "value": 178052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699514299, "uuid": "c5c421fe-27b6-4cb7-9f2b-a4c144c1ab1f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699514299, "uuid": "ac8bdaa0-5435-487f-bd92-5ba028dcb3f2", "value": "09112023_Vbs.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "686f80cd-7ed4-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699516124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699516124, "uuid": "9d75acce-c514-4eb1-87f2-bec6927a317b", "comment": "Malware payload (AgentTesla)", "value": "8fc723bd82201a4286a35093eda26465", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699516124, "uuid": "ae1ad110-c6b6-4b89-a4fd-132f49c82979", "comment": "Malware payload (AgentTesla)", "value": "0c70c9da3bafffbc5a9a07fee8f5ea27a185db236b429b016efa2ae3f683d83f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699516124, "uuid": "fc5a011e-bfe9-4275-ad67-2b1ceb4d6a40", "comment": "Malware payload (AgentTesla)", "value": "774b912385e219445f26254af8a0dd5f75a5a80a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699516124, "uuid": "12dfd736-4049-4516-a7af-a5c55dab58cf", "comment": "Malware payload (AgentTesla)", "value": "c13cd4cd35740e1b8a9c01b0f10f7981bcd8f74f06fa1ce4bedcfabcf9c0e14c841455c1ea770d061f41284c24388c3e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699516124, "uuid": "8e9ce832-10d9-40db-baf6-dcea73ad2f2d", "value": "T1A6E4E09D32507ADFC897CD76CAA82C78EA2074BB571BD247945306EC990CA9BCF141F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699516124, "uuid": "e175047a-d0f3-46f4-9dcb-38f91fe0c105", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699516124, "uuid": "e2d04f23-19f3-4693-81b3-5484befc2e6c", "value": "12288:ufTKW4bJqjn95HTavJoVlOXt+uShSeYKlkGLeR9enS2QRWc4hQwW3zVx8SDTrG5C:yTKW4bUjravyVAevlLLS0Q/oQp3v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699516124, "uuid": "43566d88-52d1-4df1-92d9-05696724673a", "value": 668160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699516124, "uuid": "559002a8-28e4-454c-964f-0414161b8b2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699516124, "uuid": "fdace48f-506a-458a-9d3b-ba01b0ef2f4a", "value": "DATA SHEET.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e3385c5-7f55-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1699571485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699571485, "uuid": "5fa43d3a-6587-4d08-9890-d3eb3943f91e", "comment": "Malware payload (Mirai)", "value": "4c71183dfa54b1803af7bad3478f5460", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699571485, "uuid": "461162d8-491b-4bd5-be39-21cb32f6a65a", "comment": "Malware payload (Mirai)", "value": "0efd5e22f69c33954fbbf56c62cdeed6407fc537a9c51e27c089c04e9a14ad22", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699571485, "uuid": "2c23dad4-c4cd-49f8-b70a-e112e456c3ff", "comment": "Malware payload (Mirai)", "value": "72ba347c6f45f14c029a9bc7f4c14f1c5adc28ee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699571485, "uuid": "9730112c-8e70-44f1-89b3-a66ae15754aa", "comment": "Malware payload (Mirai)", "value": "7b264135703373984a9c7b71f79ebcf3b2bc729865f31d28d4d430ba13470a5e6bbf8238e89cc2883c61a89c72b84344", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699571485, "uuid": "ff6ace86-b073-4f9d-b771-9b6584e2610f", "value": "T1F893D709BF610FF7E8AFCC3709E91B05198C550A22A97B367934D868F64B65F19E3C60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699571485, "uuid": "4caed223-4fdb-49d9-b64d-9fecfca58da5", "value": "1536:nSITUINkErQWG6bZn4fHoSAkeI91rFSEZa72Prn:nSITRNgWvt4QifSE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699571485, "uuid": "9019b83c-c1a0-4fc5-b324-0075c4e69e02", "value": 97568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699571485, "uuid": "325c7c9e-913e-49b8-93d9-e4239bfc9c68", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699571485, "uuid": "22bdd51d-a1d4-4937-931d-a0efb835e2ce", "value": "4c71183dfa54b1803af7bad3478f5460", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f4fbfd3-7ed0-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699514391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699514391, "uuid": "b900c1e9-9dc5-48c1-b0c9-2e2a93e6debb", "comment": "Malware payload (AgentTesla)", "value": "ff456ac1cfbee9c9142f1d33ff9e3fc6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699514391, "uuid": "81a2c2bd-1d15-48d4-872e-daee817a20f4", "comment": "Malware payload (AgentTesla)", "value": "0f8fd5a5feaa9270ee0a0a52d2fa4ce3e4ebb903d1e2a7322817fb0b76479783", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699514391, "uuid": "81449e4f-e435-4585-b28e-b328bd7abf07", "comment": "Malware payload (AgentTesla)", "value": "35c318090d3197bec05579d0d39f22d50e88b37f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699514391, "uuid": "8077e16b-078a-4d8d-a593-a02097c620b8", "comment": "Malware payload (AgentTesla)", "value": "6186b187c8f6ae56e205a8de39cc9fa476c9c1921de10354d57b41d45d82472f5d3bdcebb10b0a3eb3897bba114412e7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699514391, "uuid": "32a30098-669a-48b3-b32a-f1ce96e632ea", "value": "T1F2E423E921BA6FD7DBAD3035CC962354A31888439A5CF0AC59B3CEDE74716D3C18618E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699514391, "uuid": "b6029b4b-bd31-43f1-a8ab-b75805ce8f93", "value": "12288:hSxvO26uj/vi9P5l46ysTtvXUe6k8T9xva9TSiNDMKw0b8ICEnS4EjtklDzME7:hSFmuvil46ysFXUnxxS9TSiRM4zS4okF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699514391, "uuid": "4deaf783-1a1e-4725-b53b-79d3e989a3f5", "value": 715131, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699514391, "uuid": "65a2d859-f8e9-485b-bd8e-11cce90d3370", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699514391, "uuid": "e620cbaf-764e-4a65-937c-cb39ebdb62e6", "value": "PURCHASE ORDER COPY .xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2ead9e7-7ecc-11ee-8907-42010a9c0042", "comment": "Malware payload (PureCrypter)", "timestamp": 1699512920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512920, "uuid": "3aa9687e-f1c1-4fd1-8ab7-9d5901ebb794", "comment": "Malware payload (PureCrypter)", "value": "946e6ac5c9419d7b6f7e73b2003b9a8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512920, "uuid": "b120e8a4-f4ce-4217-85e8-8a8a76649360", "comment": "Malware payload (PureCrypter)", "value": "1025bf7f2da7b70aa2c8af71e77087efad56fb5cca94002e8fa100afd4963be0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512920, "uuid": "c977fd02-823a-43eb-bf30-dfb3f6ba264d", "comment": "Malware payload (PureCrypter)", "value": "1dfe56b72c84b85332bcea2326d325eacd9e6806", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512920, "uuid": "c2f8623f-45ca-42b4-9d21-9384caa4ccdd", "comment": "Malware payload (PureCrypter)", "value": "6d4a4f487f5d829b835650cc50309cae50493cca63c6c93cc7a852cd7d3bbb3923b463dc679457019218fc8fd9601fe1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512920, "uuid": "80ecf742-a73a-4666-a882-bcaafcddfe0d", "value": "T1136208849A6DDAA3CD1F0AFC6DBB47631A31F3569445AF0B358CB2063D43A13243A75B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512920, "uuid": "3de76691-2e0c-4707-8b73-c4c81adbbbc7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512920, "uuid": "d3528317-a8aa-4b64-93cc-61cbf716059e", "value": "192:aBFSb9VrrvWvJdxQE8KgKAl4pYjEizUe+q/wSw185mZfiiLX2HS9yxSyrsRt8G34:+wXSJ/8DKhs6Y6gwiiay9ycyrsR2vZW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699512920, "uuid": "16569712-537c-4559-9443-b1da33d789bf", "value": 14848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699512920, "uuid": "e6c72366-0d51-48f4-a93d-3fef92f7c740", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512920, "uuid": "4da44066-b8a4-4df2-9efd-4844800c1ceb", "value": "Product 2.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16047c4c-7f45-11ee-8907-42010a9c0042", "comment": "Malware payload (RecordBreaker)", "timestamp": 1699564519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699564519, "uuid": "dec50b18-c3b7-43e2-953f-c34708669bde", "comment": "Malware payload (RecordBreaker)", "value": "cf69a1bcc2bca179421226d1db90656a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699564519, "uuid": "5bc7da76-0b4c-4921-86f1-d081df7b7d13", "comment": "Malware payload (RecordBreaker)", "value": "109a3335acfba59ca8edffb0a55449fdf9c2a08fca4a9c0f5cad7dde40ffbbf2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699564519, "uuid": "7eeedd32-b602-41dc-a87c-942dd6ce8f12", "comment": "Malware payload (RecordBreaker)", "value": "f5d5749174b606e87dd6316dff6ae817ed975966", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699564519, "uuid": "5e660764-cf33-4ceb-b736-3faaa31d7093", "comment": "Malware payload (RecordBreaker)", "value": "2634bab1c344aa49c2a171e7734ed65d7111a607677d9dce5c422316500386a9e1afd54fa6ff9952ca672880ca66a2f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699564519, "uuid": "3ee9864d-16fd-46ea-bc9c-07e7b57a9d3c", "value": "T126446E1392D17C7AE5234E328E2AD6E42A1EF9618F16B79B13F4EA2F09701F1D172705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699564519, "uuid": "10fe5273-5ffb-4174-9038-1c00532bf642", "value": "cb7a51bdc8561380e94253a2cf0d849e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699564519, "uuid": "37e307e4-fcc3-4c89-8ed5-29cc6b899b03", "value": "6144:s7d2ctBfG4OJ+CA+x3noRQZNt4MPSziInb:t+BfG4qtpmQd44P2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699564519, "uuid": "c9077dc3-b9ae-4cf2-8e55-8cb3580f5abc", "value": 275968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699564519, "uuid": "9b95c028-06b5-4f96-9c7e-0fe60c7cfa97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699564519, "uuid": "51e15ed5-7b46-463e-b795-3efc4fac8cc8", "value": "cf69a1bcc2bca179421226d1db90656a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e53bb3eb-7efb-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699533084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699533084, "uuid": "3ed496e8-c540-422c-9957-4857035a9257", "comment": "Malware payload (AgentTesla)", "value": "ec5e9334f65168cce67cd57bc6391d0a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699533084, "uuid": "c1dafe24-9ede-48a3-ba50-f2241ccbafc3", "comment": "Malware payload (AgentTesla)", "value": "1105c0024a2f2173d5bbda6f209168a34ed95d5cdb05f72be075ef301ee0f63c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699533084, "uuid": "6c85608f-54b8-4101-8a6d-869b35786318", "comment": "Malware payload (AgentTesla)", "value": "4f2ac65623e89a9457cdd5fc51dc5d747b4830e4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699533084, "uuid": "18cf51a8-85b3-4930-b007-a5b5d2a8b8a9", "comment": "Malware payload (AgentTesla)", "value": "9874d9f3bab3ce2267d129ef1c5031de65055e2a41e887848e2776b9d73c3e0e7cd8d5980b367725a6098cb31bfdfe68", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699533084, "uuid": "69d287ef-7364-4a52-9e46-1a9106a34938", "value": "T1ACF3286992DA4D11D33F41B4C9F111080BB291B7966BEF5E0DB1ACFA3A163C3362E875", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699533084, "uuid": "225127ec-04e5-4a27-9075-879b4fec95ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699533084, "uuid": "d4e02950-bd4e-4e29-afea-18720f264610", "value": "3072:F0bSuwHqR5lFG/utKaEB0tPE8Q2s/WBLN:TuHR5lFG/Rloc84W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699533084, "uuid": "4da413c2-1d1c-420e-81e7-af156006dba7", "value": 168448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699533084, "uuid": "b71ce7d9-403a-4f17-9c55-7b2b691e30b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699533084, "uuid": "b4b0aaaa-88cb-4ef3-a9d5-aa2789945ce2", "value": "1105c0024a2f2173d5bbda6f209168a34ed95d5cdb05f72be075ef301ee0f63c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1f099f8-7ef9-11ee-8907-42010a9c0042", "comment": "Malware payload (RisePro)", "timestamp": 1699532246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699532246, "uuid": "6b578e29-f6df-4866-aaba-36f23324e15c", "comment": "Malware payload (RisePro)", "value": "5beac4716e5cbdcf2a46f63b994d5c80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RisePro", "colour": "#92F3D0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699532246, "uuid": "b707be3b-1648-4923-8231-f69ec608ebc2", "comment": "Malware payload (RisePro)", "value": "1121c25f4161382fa05cdc47a77284263fb1c474b10a182bbfae56ae23dae443", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RisePro", "colour": "#92F3D0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699532246, "uuid": "a01cf839-d262-48cb-af8b-c9ade803ea0c", "comment": "Malware payload (RisePro)", "value": "6d306a6863f573989a4b745bb1bf0c042c90511b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RisePro", "colour": "#92F3D0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699532246, "uuid": "c81bf121-c076-4ef8-9c59-85aa675c5f1e", "comment": "Malware payload (RisePro)", "value": "d05dbd1195299cde6d2947bed2b3eabec4c5ac0611ced6362cf01b61503bffaf4f13183bbd2c9a4073288e18404b6e4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RisePro", "colour": "#92F3D0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699532246, "uuid": "6f02def5-d5d1-4db5-a86f-966b335c59dc", "value": "T1D456338EBE4155ECD049A9F85645BF9C3CFE2F3899548D18686CAFC36E43A708532723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699532246, "uuid": "dfe85627-0b89-46e0-8793-1b0f3d8297bd", "value": "d6a6642d29b3130fbd3b4db016d947da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699532246, "uuid": "a8a2d3da-740e-4ddf-8483-431515de63f6", "value": "98304:6HKTTGUsV6vb+uzK1JdDlMIVA9DQ7yMz22HN/yEqUKXyXKsRH47CN06dzs7YkcbV:LeUqIb+K4JdeEA9bMVHcEEK/RHW60EzN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699532246, "uuid": "64c259e6-ad0f-4e03-8331-0496d71b908a", "value": 6111744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699532246, "uuid": "b158c1ba-c9da-414a-83df-bed47d906c12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699532246, "uuid": "3125fde5-8a2c-48a8-9c50-3f5a85ed1eb2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "372fb8d8-7f17-11ee-8907-42010a9c0042", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1699544818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699544818, "uuid": "f4a8accb-840c-4d8e-9742-871a248734bb", "comment": "Malware payload (Adware.Neoreklami)", "value": "64241b8c3e6846d48ddb61b6594fcd42", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699544818, "uuid": "58eaa396-a31a-413b-9b09-29d5eeec2a30", "comment": "Malware payload (Adware.Neoreklami)", "value": "12100dde5cf7e63d02eb05feaa620baa62c8fa6535f86554a2986dc0c5642122", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699544818, "uuid": "6830f874-f080-4596-83af-8668d14277bc", "comment": "Malware payload (Adware.Neoreklami)", "value": "6943db2a99db6451118819de598919705798bfb1", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699544818, "uuid": "33022bce-c1fd-4a19-b77a-1d0335ebaf8c", "comment": "Malware payload (Adware.Neoreklami)", "value": "398826c95a2dcd4decf839725443925a68d1de65cd922a3ba6d78a2d5fec49483988f9bbb43b7f40591210555aec3041", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699544818, "uuid": "8a219d83-590f-4833-9848-c718afd7e714", "value": "T18D76331AF7F1C8B6F3E010304AA252E967F1CD951B7501DF3BC206ED6DF38968A4916A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699544818, "uuid": "21b72437-7de2-4f3c-8a26-8f87b4e214d8", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699544818, "uuid": "5a49512a-c2ac-4c80-8c26-b3e94e3bbf96", "value": "196608:91O7vyGWHLVoN39o3Mo8q4fEl0h9S7hY9ybFa8B0:3O7vOyNeMo8DEMEHB0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699544818, "uuid": "08f59259-a816-46cc-b9cb-7943ab6194e0", "value": 7508525, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699544818, "uuid": "0237e5d7-1c27-4042-aaa0-aa60fb3badb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699544818, "uuid": "882eedc6-a539-4b4b-8221-48d2ef6016aa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed770f69-7ecc-11ee-8907-42010a9c0042", "comment": "Malware payload (PureCrypter)", "timestamp": 1699512911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512911, "uuid": "ebf9e8e9-5a83-47d6-9a8f-d1078dd2811d", "comment": "Malware payload (PureCrypter)", "value": "67cd1a9d5e41c543b35cd7578496cb27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512911, "uuid": "3e0601b8-2b73-4d00-a180-3f1e0ff623f6", "comment": "Malware payload (PureCrypter)", "value": "1337c73ff8e17b9fd8d9a63b17e56b8c1ca0f6b09707c603644ccc968c60fc8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512911, "uuid": "b8de7712-8c32-476a-931e-ac27bf1e5d1e", "comment": "Malware payload (PureCrypter)", "value": "fccfeb544145c3fab551e2d13df349357f03015b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512911, "uuid": "5b156fb4-ac15-4803-baaa-c7654fc31a89", "comment": "Malware payload (PureCrypter)", "value": "f96fdd5efa12547c50aae1def79ae19004707ee879e2d908c9e895665643922ef39718f09e9c8f7983a9e55848ef8778", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512911, "uuid": "09c892c2-9b7e-416a-b696-9ec2e1123fe1", "value": "T1946208849E6CCA53CD1F16BC69B747532A75F6169444AF0B39CDB20A2C03613683A79F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512911, "uuid": "7de1e718-2a20-4b2c-898d-77069e697fbe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512911, "uuid": "c4463c76-9af2-4b12-948f-8c86e5572c89", "value": "384:CwPaJS8DKTqYkUyKQiiay9ycyrsR2vZ2sR:uFUyKGycyrsR2vZ2sR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699512911, "uuid": "2f24b269-aa8e-4367-a338-733feb3f67f4", "value": 14848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699512911, "uuid": "903f1070-6a6a-4723-abc4-2e1310ed45ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512911, "uuid": "11302480-adc4-4fa1-8769-8539bffc0fdc", "value": "Sample Design 2.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0751dd2-7f0a-11ee-8907-42010a9c0042", "comment": "Malware payload (DarkGate)", "timestamp": 1699539465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699539465, "uuid": "49dea11d-ef12-43e0-949c-9e58f34af106", "comment": "Malware payload (DarkGate)", "value": "b428fd3b31d80dbdbbe4ee4949cfbe54", "object_relation": "md5", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699539465, "uuid": "21c4c54c-a8c1-46a5-946e-d2d85ff881b1", "comment": "Malware payload (DarkGate)", "value": "16613e7c07681726ab577e6ac14114cb42691838fa3c6c4c1bef7dafa2c7c4a0", "object_relation": "sha256", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699539465, "uuid": "9ae97156-fe7f-41b4-abaf-5515510ef549", "comment": "Malware payload (DarkGate)", "value": "3f39780bffd9b6b04dba52843622497606808020", "object_relation": "sha1", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699539465, "uuid": "c4579285-87cf-4775-b753-5114009ccc1d", "comment": "Malware payload (DarkGate)", "value": "f0351790f54630952ed27ed5d6633ffdaeb691eb7dd43283e52bdc7b8f68afdbaf7b02c3cccec2db23a54b2c0e92f12b", "object_relation": "sha3-384", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699539465, "uuid": "e2258fa7-b118-4ced-b41d-210bf1616595", "value": "T17644852975DB21224B37B3779F5E6008EB6581675D02A104BCAE429C2FF895801BBFFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699539465, "uuid": "7969b946-06cd-49ab-bd58-c9d863a5ba35", "value": "6144:Fe7hgXeerjqlI2Iro+lJe7hgXeerjqlI2Iro+8:FIhgSlI23mJIhgSlI23V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699539465, "uuid": "762394ba-2909-44cc-adf6-73964674816c", "value": 258866, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699539465, "uuid": "1a14019a-e9f7-4484-b944-bf741f1e4c78", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699539465, "uuid": "18b27f2b-9f1c-4bbb-84d1-be2132fae6a6", "value": "app(060e45bf7b57d4).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "318fe75c-7f40-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699562418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699562418, "uuid": "bb9a8f90-30eb-4c71-80fb-b34c240b92af", "comment": "Malware payload (RedLineStealer)", "value": "1dd3279447e1790ab2b4fbba22ddaded", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699562418, "uuid": "b45bb16c-06c5-4613-9e33-ca6c1872e792", "comment": "Malware payload (RedLineStealer)", "value": "16624dff9366edaa52f78d3336fafc6eabc470f992cb615d542da97fe2b8234d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699562418, "uuid": "4dcea026-e003-4aa0-9004-f310bd026e03", "comment": "Malware payload (RedLineStealer)", "value": "7fed39367c9e341b636e0baa803a8f534d59b11c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699562418, "uuid": "1b2745aa-ef91-4989-ae55-5de8b25dbaa0", "comment": "Malware payload (RedLineStealer)", "value": "03c141a25f93a107f10bea72588eb95207111ba152cb71f100c844a73df561f4eb35bf7ead90125747ad255e4fc056f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699562418, "uuid": "bf10ce72-4996-4a80-bbc1-bf73027a0f17", "value": "T13EB41247FBE84133D9B513B158F607D30B35BCA69D78426B378A984A0CB26D4A93173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699562418, "uuid": "e80db550-9553-4c83-8d25-9716560fbefe", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699562418, "uuid": "7a08264a-4de3-40ac-8030-f8b90ad6e27e", "value": "12288:pMrPy902pkjlm0wFs61h/+V5Skd61C0UMEVZj:iyLpkvwlh/5kd6Q0Ubvj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699562418, "uuid": "aa425aaa-0ad6-4809-9bcc-dde80a65e5e5", "value": 523776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699562418, "uuid": "cc8d1fe3-40e7-4e9f-a23d-9f106619e5ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699562418, "uuid": "420c7bbe-fd7e-4a33-ae1c-0e39d13b124d", "value": "1dd3279447e1790ab2b4fbba22ddaded.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac197598-7f34-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699557469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699557469, "uuid": "444e9d29-7988-49d4-9232-525584eae66f", "comment": "Malware payload (AgentTesla)", "value": "1e9aeb8f40bb30f7b9188f24efd3977f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699557469, "uuid": "b7944300-7def-4cae-b55b-6a66916292ee", "comment": "Malware payload (AgentTesla)", "value": "174e2237b3157582189f15393ba0a1771ac0fb62fb479690b46de1b61071b491", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699557469, "uuid": "12562370-1620-4346-9e37-30b60e09f0e5", "comment": "Malware payload (AgentTesla)", "value": "d74fcae05f0c2bb1fb523d6f4ae9d4dff8597027", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699557469, "uuid": "4b80e4a5-edc7-42c6-b703-011f98f3bfd9", "comment": "Malware payload (AgentTesla)", "value": "2e7c17cbee21fff56257c8f9323161b49b4dfb72d5a77ceab593b7ec437d200e64c576ded1ac27d47f4cdde4f1522021", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699557469, "uuid": "f917baed-161d-43d6-8957-e20e1da0b98e", "value": "T12BD46A3D59AD163BC1B9DFB18FC59467F1D4A9AB7052AD78A8D303A60342B16F4C023E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699557469, "uuid": "ba47ac12-a1af-4f4d-8ee2-fbffc3ed7991", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699557469, "uuid": "bdb8354c-ec6c-4016-ae08-f893df41399c", "value": "12288:Z8Y06jXsC4EssiduMoG+tW0F+N2svdgOxOL8b9eaBtQix5yowQAof1:OY3jB4bsiuMoG+tRrSO6OS9eavQiOpo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699557469, "uuid": "458a14b0-5aee-4f80-9213-65775b4090cd", "value": 653824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699557469, "uuid": "98f1a8d1-0765-40ef-81f2-2eaa7960825d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699557469, "uuid": "d0781df6-f99b-4dd1-a58a-5e4f3f6a23fb", "value": "SecuriteInfo.com.Trojan.Inject4.59820.18792.6250", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b79139e3-7ec9-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1699511532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699511532, "uuid": "40cded1b-3fb1-4af6-9118-554314b2c76d", "comment": "Malware payload (Stealc)", "value": "2599c867c0f96b06c1077b1aeb070ced", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699511532, "uuid": "ca12e999-77f2-4adf-86f8-49078bd12859", "comment": "Malware payload (Stealc)", "value": "177e00b9175644ff2cc87a92845953f7a5090b92d02525be0941604b6396a36f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699511532, "uuid": "a2d6857c-c5ee-4d2a-a18f-3f7c1375b690", "comment": "Malware payload (Stealc)", "value": "042755772f69edb4a0348cf069fffebae3bb63a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699511532, "uuid": "c9308979-e0ff-4acd-9c4c-ffff50ac237d", "comment": "Malware payload (Stealc)", "value": "df663272a8742d1484611700d8bab1dddd9e9ef53291e22ffa3d18189b5e9018be5597cab948252ef6e87266d3e4db2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699511532, "uuid": "0b7ebedb-6817-4100-bef5-9f0fc8c465a2", "value": "T1AE445C13D2E06C7AE5234E318E6EC6F82A1EB9614F55779A23F5EA2F09701F2D572301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699511532, "uuid": "bf8c4635-8884-48e7-8b98-5770e96c7300", "value": "87faac0e91f030bc1bf4edcc16f72277", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699511532, "uuid": "ca6b86e0-cc61-4a7d-bc2c-5a3c030416e5", "value": "3072:kl/NzfW9/v3KysjvULmnTwCKxDoqA+uL7DSL0lHzVRhcvqVOb:kDfW9/va1vUL4TlKxJZuO2NtE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699511532, "uuid": "ff9df7bd-2b09-43b7-9ebd-fc1f288a4fda", "value": 262656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699511532, "uuid": "8a387e46-c180-44aa-bf5e-173fb1aaa0df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699511532, "uuid": "6f7b55fe-c42b-4d19-b64e-fcd4f753869e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b22faf8-7efc-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699533174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699533174, "uuid": "3b3e6308-86f2-4824-b2e3-aac4bc930a53", "comment": "Malware payload (AgentTesla)", "value": "db24e7c1bf8808d70a2bdda8bebc127c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699533174, "uuid": "5fa254fe-ecbc-4574-8dd5-a5bd44ea2aea", "comment": "Malware payload (AgentTesla)", "value": "17c63004d1c89b8dac856bbc3fa3cd1fdf04eb6386fd9488b243c3d09377fec5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699533174, "uuid": "09bde814-8407-4e24-aba8-cae57cdb5691", "comment": "Malware payload (AgentTesla)", "value": "d5b7e76421786081cc4814411fcf45bedb7c9ac8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699533174, "uuid": "ca6463cb-8ec6-4e25-be30-789704f17c42", "comment": "Malware payload (AgentTesla)", "value": "0e0b4b3632cbb7be082587dc553a81f9ffe225cc516110d268af46ad238db0fd6603d72553480482cbf18df46e9e5627", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699533174, "uuid": "d3208375-496f-43a7-a3f6-06acc9b9c9fe", "value": "T14FF3296892C98E52D32D40F4C4A4111B56B2E1C35287EB9E5EB09CF63F5A7C3362EC76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699533174, "uuid": "58e7a166-1fea-4818-b4d7-a8be17cee8be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699533174, "uuid": "27a5e004-c50b-40b9-851c-743f4873ed17", "value": "3072:J3aCmYcTJR1xhYzkkWWflGB+vh3DSp0fdahRSzOlF728h:lcNrXc1W7B4kWCgzEx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699533174, "uuid": "a1797eec-072b-45a6-914d-ca9c3d4569f0", "value": 167936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699533174, "uuid": "9fa4d0de-d4f7-4113-9631-a211158cfdb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699533174, "uuid": "6872457f-7f23-4b23-ba78-0a54daf6f105", "value": "17c63004d1c89b8dac856bbc3fa3cd1fdf04eb6386fd9488b243c3d09377fec5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f3090b0-7ece-11ee-8907-42010a9c0042", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1699513397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513397, "uuid": "06223459-fa85-40b5-97a2-c9603ae7ac0b", "comment": "Malware payload (AveMariaRAT)", "value": "1c5e702f853db4ea6dfc52afc705ce4b", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513397, "uuid": "2aadb616-8e7e-46e3-a04b-2a661ed0dcbe", "comment": "Malware payload (AveMariaRAT)", "value": "18d762a8883423ac79419728ba8a35b63a163e3453eec061c9865d77b93f1be2", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513397, "uuid": "3eef9476-92d8-4b18-ba80-a6e0d0bf485d", "comment": "Malware payload (AveMariaRAT)", "value": "72f1d8e56c51a05bd6f3594ec6fd696c889e54cd", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513397, "uuid": "8e292344-7aa2-4269-9083-76b17921fac3", "comment": "Malware payload (AveMariaRAT)", "value": "1d6ccaef4981f02c2385a03da97afa4a0acccb9b42a9ea79aaa7428cd494eec78df95095277b746847522ba71576b3e2", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513397, "uuid": "caf5e7b3-2b1f-479e-a696-983d78eb085b", "value": "T16F156A07BABA89B2C984D735C1D74A1067E7DE8567E2D609258973ED0A333BE8F07143", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513397, "uuid": "f85821d9-a107-409c-bdad-b031f26a4dc9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513397, "uuid": "4bbd87a3-6e92-45f4-915f-d255db1f812b", "value": "12288:32QrmzjF+itr4fb8GhoZ3VY7RpgMLa5K+UQMlpBTTit:pmnFtF4fbGila5KzFlpti", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699513397, "uuid": "bb869fd4-c8f6-4971-a768-5f2e4ea622b2", "value": 909584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699513397, "uuid": "028e1d11-51bd-49b3-b501-bd393bf197ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513397, "uuid": "f6acb83b-5e7e-44d4-99b6-cb85e5595d06", "value": "ORDER LIST_NOVQTRFA00541\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2877b492-7f13-11ee-8907-42010a9c0042", "comment": "Malware payload (Pikabot)", "timestamp": 1699543075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699543075, "uuid": "e5a91adb-3154-474e-8291-460eb30db19b", "comment": "Malware payload (Pikabot)", "value": "70083e343b9eb698eeb602f6948aac1b", "object_relation": "md5", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "pw-H17", "colour": "#5A0D28", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699543075, "uuid": "a21ea84a-b3ea-4c5a-ad97-54fdd39b9ac5", "comment": "Malware payload (Pikabot)", "value": "18f432bfb7acad05a2de36b795edd4f2c8390b367f37574a75928dbfd1dbe4a3", "object_relation": "sha256", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "pw-H17", "colour": "#5A0D28", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699543075, "uuid": "fd6269ca-1cd6-4358-95b7-49b7a236ad7d", "comment": "Malware payload (Pikabot)", "value": "9cc3866bc658a47c59f34360782c26e4cc78eb92", "object_relation": "sha1", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "pw-H17", "colour": "#5A0D28", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699543075, "uuid": "8c0599ca-f78f-44d7-a40d-670c3c621f42", "comment": "Malware payload (Pikabot)", "value": "967443ac325f64c2270469ed1d85b1da3802bccc4da8206a59cc4848f8b4ecd534d0e9faac2f6d778ef14574196fbde7", "object_relation": "sha3-384", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "pw-H17", "colour": "#5A0D28", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699543075, "uuid": "cfdbb310-5333-4ffa-93ee-a692e2a4e1c5", "value": "T18D342232B7D8C3BF4F850F387D927A8A03CA545964847FA8AEF1A654ED05C233136676", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699543075, "uuid": "d801cf7c-99b9-4507-9d22-faa42a3394a3", "value": "3072:kxpdg6qcX8QVyLMujue3JgJ9fm5szwFWf9y7DiDFXMKCl9m0xpL1kVn2mQlhuhXt:LwXeMuaeZgJ5mazlycvCl9DL1k9Qlhct", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699543075, "uuid": "f1283ed4-5743-4588-819a-01e83c3eb2e9", "value": 236413, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699543075, "uuid": "4f6d4149-4170-42d8-b9f3-10fbd51a4852", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699543075, "uuid": "ea38f717-f375-4809-be2b-b7db7f4b780b", "value": "RW.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89b75b33-7ef4-11ee-8907-42010a9c0042", "comment": "Malware payload (Tempedreve)", "timestamp": 1699529924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699529924, "uuid": "9f38264f-810f-4661-902b-4ba095c063e8", "comment": "Malware payload (Tempedreve)", "value": "428712183252d06e57228e50d149c965", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tempedreve", "colour": "#F20A42", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699529924, "uuid": "9ac90f62-f7dd-46c3-967a-2459b1d45005", "comment": "Malware payload (Tempedreve)", "value": "1924201b14b7360b313cc430cda58faf88a16f7d7824fbbfafc4b5fc6ce9135f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tempedreve", "colour": "#F20A42", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699529924, "uuid": "b3ec96fd-7042-4ca1-9d72-769124334d89", "comment": "Malware payload (Tempedreve)", "value": "d1a888ef98258101b580ae7f2e5efaa1c47b63cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tempedreve", "colour": "#F20A42", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699529924, "uuid": "f70195f2-2cdf-402d-9411-fe33c751f5c0", "comment": "Malware payload (Tempedreve)", "value": "c2a8138c5c122aeebd707ca828fcf8da0c4f0439e5ae3361c3404ff35168c5523e9400612830337f3c47ae9651bd8843", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tempedreve", "colour": "#F20A42", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699529924, "uuid": "43ee8206-4ea0-4905-a85c-48c69f9d0cc5", "value": "T1263423B0AC6D6C06E2C08F73AEE68258CEE8472E71931FDD9341F94A56936FEC419474", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699529924, "uuid": "e57eaa40-032b-43c9-b795-1ff04d291302", "value": "18c89e2ec0a399c68eaedd6551ce71fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699529924, "uuid": "899188d5-a9f8-4c13-88fa-92fdf5094981", "value": "6144:P6K6u6/RwFl8Hgxn+pijMUX8kIk5pIsEFT594r/:PJ6uMRWznPhP5YK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699529924, "uuid": "6bc8b2bc-8859-4f62-bf96-c70e5d74f108", "value": 250880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699529924, "uuid": "21217e7b-a166-4fe4-8988-d3fbfd4084b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699529924, "uuid": "29b5512c-9bd5-47b5-b2a5-bfd235455cfa", "value": "1924201b14b7360b313cc430cda58faf88a16f7d7824fbbfafc4b5fc6ce9135f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e539dc33-7eb6-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699503448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699503448, "uuid": "2a432ead-9ec2-46ab-b83e-6ce96baf708a", "comment": "Malware payload (AgentTesla)", "value": "eb58f7810c8178ca32b2fa5a4e4421da", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699503448, "uuid": "edda3115-8886-4441-a3e5-c86042fa1f84", "comment": "Malware payload (AgentTesla)", "value": "19bc3eb72e52fba832a4ebbfe3737cf4ed257003039ef5475c75a6c468d99bc5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699503448, "uuid": "fdd3c37f-23ba-483e-9f6c-b42bf5ab71f8", "comment": "Malware payload (AgentTesla)", "value": "32ac3e7740660a206804caea6d0a009c29f4c095", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699503448, "uuid": "0c4e4b5b-9efc-4718-b999-5a29aa225ff4", "comment": "Malware payload (AgentTesla)", "value": "efb8e845a6d7c0c0850b960b44a536930c49d37e4a35b56efa91f316f915a06a783081bae4c04463470803092523b2d8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699503448, "uuid": "085f4eb8-e745-4a28-81ff-e9b25c03a87c", "value": "T1E2E47B3D5EAD163BC1B9DFA58FC1C12BF1D4A9A77151AD78A8D303A64342A16F4C023E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699503448, "uuid": "b324806a-4756-473a-be5f-cfc6aa117462", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699503448, "uuid": "8c6b3fa7-0f7b-48c1-9f8f-16dd52d1e09d", "value": "12288:ehJ9QZgq33djLBvW5b+puJA/1RF2f4kW2YNxmaT:ehJS3NjLsGxmCLm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699503448, "uuid": "91a01e2a-e81b-4e99-8d50-a92994be0a06", "value": 701952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699503448, "uuid": "a9f1804b-71e4-4bbd-a480-70198bf5c59c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699503448, "uuid": "1dcfd3f1-457a-42ae-9cc1-77fd6d2dfd5f", "value": "SecuriteInfo.com.Win32.PWSX-gen.13838.26255", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d63987c-7ece-11ee-8907-42010a9c0042", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1699513394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513394, "uuid": "1d56ef82-6aaa-46a9-bb00-744dcdae8cd5", "comment": "Malware payload (AveMariaRAT)", "value": "7ab3a6fd0590b53b6dec72df5534c9fc", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513394, "uuid": "d2b8c6ff-5633-43fb-810b-cdaf3e21d98e", "comment": "Malware payload (AveMariaRAT)", "value": "1cdd419aa7596bf3961df762e862152cbabce65809dc37c01066ea66c2f61da9", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513394, "uuid": "2ef1705d-4197-4376-9546-f5357808e8e8", "comment": "Malware payload (AveMariaRAT)", "value": "939f0d2f059c155c1958ab2fd577ac16ca8903c3", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513394, "uuid": "69b3167f-aec8-4b5f-86d2-aadfa52ef7f8", "comment": "Malware payload (AveMariaRAT)", "value": "e36dc4e48b0a2abe6db1b03130020518e0f2dd0b393b618758a02740d58fa2addaebc4709d62ea5695c76fc7599b976d", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513394, "uuid": "c9e72114-7f82-48e4-8eb3-4beca13d8ead", "value": "T11605F742F3B4F822D924C6B210E6A944C3E3DDD4C6E981752644B9DF973237DAFA314A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513394, "uuid": "4fe6aa75-4a4d-4a7c-aaf2-fce83500b8e3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513394, "uuid": "f51cba42-9531-43e9-9ead-01fe5ece5455", "value": "12288:kA0EdM8NapIS8pleBJju4pDdzddddWddd6:qDyxSaeBM4ddzddddWddd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699513394, "uuid": "89077d2f-e1e2-4020-92a0-54646a8bb861", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699513394, "uuid": "2ba84875-da05-46e5-8ce9-6d8e70b38daf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513394, "uuid": "91ee81f4-8810-4b05-a53c-3da684e9668e", "value": "Purchase Request List\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "363a36ff-7ed0-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699514322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699514322, "uuid": "d8a57670-4872-4d3b-b509-d15bf4826da9", "comment": "Malware payload", "value": "13e27238c762bf51db1db3cfc001addd", "object_relation": "md5", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699514322, "uuid": "16402216-03c8-46ec-98c3-bcd11b857672", "comment": "Malware payload", "value": "1d0cb42d9cd63210550ac454a1723aa4cbeab2e75fb20a6af64e184333b33b75", "object_relation": "sha256", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699514322, "uuid": "7805c5da-44ac-4cca-ad6c-d8d98ac4d4af", "comment": "Malware payload", "value": "6d21972e61df38b0c62123a99136a3307d96dad4", "object_relation": "sha1", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699514322, "uuid": "d6108c34-ed9a-4cd1-bf92-21d7f36a6b24", "comment": "Malware payload", "value": "cb4f69ae6ade312c97b0e95e5b5445a66a7efbb01fa145ae93a9effa80244c0ba7866b43ef34e7cd3951f9672df2f64b", "object_relation": "sha3-384", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699514322, "uuid": "09d425db-4bb7-4169-b8ee-fe220474b959", "value": "T1A3F18E57E5C776C5EFF5023B12BF29BEF96EE0405BA2870E24C0725C07D2406698D19E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699514322, "uuid": "e19570da-82d6-4e3a-a938-6a060cb78f0f", "value": "192:xrXP//yMHhURqowQ/f0jcUr2BSbI+ml0I/rlY:dXPSWhURX7H6e+W0q2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699514322, "uuid": "4e55c870-6c65-4088-b1c5-6ea58ddde0e2", "value": 7934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699514322, "uuid": "3e20a6a7-3e80-47a2-a06e-da4db405a4ed", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699514322, "uuid": "6427290a-6a0b-482d-a2ca-e895d0f8966c", "value": "Reserva Cancelar.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff18050a-7ef7-11ee-8907-42010a9c0042", "comment": "Malware payload (CobaltStrike)", "timestamp": 1699531409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699531409, "uuid": "73c71e61-3457-4ebb-bb98-24bda062bbb1", "comment": "Malware payload (CobaltStrike)", "value": "920ccb3dd6c1efc2fa82f6b575b5c2fb", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699531409, "uuid": "88157327-8635-43d1-92f1-9364935aaf35", "comment": "Malware payload (CobaltStrike)", "value": "1ea9fb9955366dcc5ce71309dc802489bcc02c3269ddcb2277f1636169639207", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699531409, "uuid": "5de087cf-ce22-4c6f-b074-64765e419fe9", "comment": "Malware payload (CobaltStrike)", "value": "86538c6eb429918c5da6838a927781df264c9ea1", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699531409, "uuid": "20562f7f-fb92-4bc8-9d68-8411d92ee82d", "comment": "Malware payload (CobaltStrike)", "value": "f3d7086242d40ddf334528e71d3fabb8b5303e5847723f89848a672d6610e67447a36960eff1920c3eb56d33f1baedf0", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699531409, "uuid": "c7e5900d-a001-4790-abbe-a8e0e47db2e3", "value": "T1AD821A7FB64224E9C12BD178C9EA27B1ADF27122417B2B1F1FB8CA302F21879453D519", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699531409, "uuid": "0401c7f5-62af-4607-9288-c75e0b395c37", "value": "17b461a082950fc6332228572138b80c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699531409, "uuid": "aece3bba-449a-4264-8584-bd3968aa0928", "value": "192:pDMAe4Ckj19RZZ6wpSfu1bKcq5uHj7khBDSeKNH4yHFghBUbOj6kxiY:pDMAoKz6WtKEj7aBDinChbAY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699531409, "uuid": "0c360153-8eec-4351-8769-f585fa0f1e7b", "value": 17920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699531409, "uuid": "d3101573-b8f7-4500-b039-c7365a8ddd4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699531409, "uuid": "f4f630ef-b8f6-40a0-a4b1-bb7074445f9b", "value": "1ea9fb9955366dcc5ce71309dc802489bcc02c3269ddcb2277f1636169639207", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9006e03-7ef2-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699529144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699529144, "uuid": "d2734760-123e-4feb-8a12-d7d3648b462e", "comment": "Malware payload", "value": "e657af3eace3f11b1f117c453e916e12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699529144, "uuid": "10402bdf-ef5a-4962-af1a-98f01383df66", "comment": "Malware payload", "value": "1efd37acc428c6b98b531cf1e4c37f2948ec5c4de89038d239bc6f56fec17011", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699529144, "uuid": "0d23410c-8cc7-42bc-af2e-cb819fe726c2", "comment": "Malware payload", "value": "ed18904109ee7b77787d289fc1782c06984f18d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699529144, "uuid": "6b88720b-1f97-47fa-bc27-80736daf07d9", "comment": "Malware payload", "value": "2c1bc26bfea914f590ba443eb536425caed111c018f35b77ebcb16009fcb8e3173459318385ff13e38bf35ef518d9dad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699529144, "uuid": "7778831d-97c3-4fb8-a88a-2a36a1355358", "value": "T1767401AE7A19D836C01C0D344A13DBFB5F705D509D558A0B7AB1FF1E3CBA291BE6009A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699529144, "uuid": "c887c0b3-3346-4aac-a37d-8a772be23710", "value": "7fb585c1fa48337fcd9f42e8a00c6002", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699529144, "uuid": "5292bb3d-8cec-4748-a353-a70a5a636530", "value": "6144:z1o/rZ8KjVetvfFVz9G/j9+FGQB2AaPSSWe49LIyMrN3F1+:ho/rvjIfNlGo2AaPhe9LIyMRVM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699529144, "uuid": "da701497-ed45-40f7-993e-df6f8fedf6cf", "value": 360716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699529144, "uuid": "292989fc-a222-4c9b-8867-df44365403bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699529144, "uuid": "f3aaa1f1-618f-4319-96a2-09cda3369612", "value": "1efd37acc428c6b98b531cf1e4c37f2948ec5c4de89038d239bc6f56fec17011", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0fb249c-7f1b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699546821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699546821, "uuid": "6a219ba2-04bc-475e-9d5f-7882e5e37105", "comment": "Malware payload", "value": "bed063565678cce483a7647b3fe5dd27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699546821, "uuid": "ac27038b-a268-40bf-bcc1-8aaa6362b040", "comment": "Malware payload", "value": "1f88fd853dfa370210529bd0fc8130305d0678ee3cb920dc92104aa4bc075b89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699546821, "uuid": "725182dc-a65c-4865-8b7a-e83a50ac2f10", "comment": "Malware payload", "value": "1680572534a64996a8316b3ac01f7cfb9602946c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699546821, "uuid": "4c64035e-1148-4f02-b64c-ba2ce2d4f7ce", "comment": "Malware payload", "value": "dd6305e0c1e5aec373ec4967250f45faf1d0bac15bd295b0e6ee380b78c2679acd6c17458500b23d8d61170efb160cd1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699546821, "uuid": "4aac700e-02ce-4fb1-9313-3653f63a86d9", "value": "T19D445C1392E17C7BE5234E328E2AC6E8261EF9618F5D779A52F4EA2F09701F1D172701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699546821, "uuid": "854601af-48c6-46ca-87f9-54f541654497", "value": "bdd0d029a2e2ed32505aee0758e09d05", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699546821, "uuid": "71a8f8cc-f407-40e7-bf6a-383b6ce60a7b", "value": "3072:WgxS2Gtjsjy8j3kV97jBha88TW+h7Aar7fTley+oOyx:rdGtjGF3k7thzQdAar77ln+F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699546821, "uuid": "2220bef5-b489-4d2e-a4e8-33d1f1132a85", "value": 274432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699546821, "uuid": "e76241a0-f3e0-4302-8c4f-6a8849894e28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699546821, "uuid": "c2dd66f8-a8a4-44bc-bd1a-e642dbb5cd41", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f88a0fba-7f50-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699569623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699569623, "uuid": "2f536505-3e9e-4d20-8a92-84049f8ab3e7", "comment": "Malware payload", "value": "3d9eb57dd6bdf6e9c45e43900ab7905e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699569623, "uuid": "26688890-bd6b-44d1-ac55-dd32bf4fdc87", "comment": "Malware payload", "value": "20a47ec0ba2e2dbc15def747e17d2d405d4d0175f3cf5f69f2808913cf039e0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699569623, "uuid": "8460ff3b-fbab-46e3-b064-51cd3817aa7a", "comment": "Malware payload", "value": "2a4d3ef344802c560b6d0177941e019494c4f72d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699569623, "uuid": "65837c8b-c7e4-4bcc-9db1-bd5f7db0a8ff", "comment": "Malware payload", "value": "0ce4e654d9bb245bbb81d4869333925e4725b9c6639ea22e61e14070d277b53e83ce9c6706bbfbe8ac0d0dc9f3e94570", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699569623, "uuid": "6c5c9de2-4f8e-4933-9cc2-90239c8a03c6", "value": "T16275AC46F2587DADF16690FE8CF24626A1612B0543F192C7224F876A6E132FF0DB63C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699569623, "uuid": "92617fc3-9bfc-493d-8b57-f356681edd59", "value": "82b2653a74c75f357a7b655127ac48ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699569623, "uuid": "86e8214c-3b0f-4d93-919b-ab0a9c7f8265", "value": "24576:eZy1+PtfBI924jYsitPJCEqX22fgtwAdQstAcCXcmhR3yr1E:eZy1+bI97IU22It31HCMmhU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699569623, "uuid": "7272f4c7-0397-4b65-ad3b-5c176e258a8b", "value": 1571840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699569623, "uuid": "4933e66a-ff07-4933-8b8a-8c99c6c9fca5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699569623, "uuid": "eefcf91d-faa3-4b5b-a13d-82e8e4052718", "value": "0711.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc006d26-7efb-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699533041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699533041, "uuid": "2811e818-07e0-4203-95b6-ab330948bbff", "comment": "Malware payload (AgentTesla)", "value": "2a30fc47d06bb0e6ee1cec34365ea6c4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699533041, "uuid": "456f7e93-e387-45cb-8e50-bf0cdfa4e196", "comment": "Malware payload (AgentTesla)", "value": "2156326b5852e3217ecf025b29271e9c8c3c892e9f13c89045fa7166b336f7f9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699533041, "uuid": "57e01f26-6e41-4e29-adcc-9beab8cf05fa", "comment": "Malware payload (AgentTesla)", "value": "a3d1dcf099b9b9a49c3084dbbdab1af8d2634471", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699533041, "uuid": "ae551c90-e323-4f1a-9fa4-ab08ca2ef524", "comment": "Malware payload (AgentTesla)", "value": "565d81479270d3d8d9ec32aa4eaf0b94602e3a0534e8c7547c1ae9a687e9d31f011e7fda366ecdce3783fe5e612bd5ed", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699533041, "uuid": "59cb9186-b647-4429-b367-fc4e15f295fa", "value": "T132C46B07BB8295EDEE55763AC5878838836790C19633E30A75EF23DA1F433126D6B346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699533041, "uuid": "e428d099-d39b-4405-a9ce-58f778b4af51", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699533041, "uuid": "0b0d4b54-a4b4-4f2b-8885-d2719d7d35a2", "value": "12288:9Tb+oafHbsRhm87znlyFFj31bXnnDMy+huJvuZ5H84w:27am88/+hutEs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699533041, "uuid": "a36cf0ae-69d5-49d4-80f6-8f1a39326094", "value": 557048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699533041, "uuid": "67a63b22-460d-47f1-80de-fa240bd98608", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699533041, "uuid": "b66ad5b1-49fa-4694-b8bd-4e000ee7d942", "value": "SecuriteInfo.com.Win32.PWSX-gen.30892.23960", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a102d3ad-7f1b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699546713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699546713, "uuid": "7bfc7817-d644-4ba5-8a7d-0fac54f24c0c", "comment": "Malware payload", "value": "4749541d813beae6e86297bc628fe503", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699546713, "uuid": "5a95383b-a7b3-459a-8020-cbd100d44680", "comment": "Malware payload", "value": "249679528a5e1ef5ab81330cfda85cb63a56653c5b5c881bcfc477a4a2261735", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699546713, "uuid": "ce68b321-66b4-4e6b-8c7c-746ab030099f", "comment": "Malware payload", "value": "5539edb410d065e46d208d381789fa2697f6a4fb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699546713, "uuid": "53710824-5413-4202-b69f-aedb6c5fd172", "comment": "Malware payload", "value": "ca518f1a8de02daf1d74803f4b5b154c6424d54a51b27bcbc5751b02ef320e8c3fdd04adc1775cb453e57a4786cd56fd", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699546713, "uuid": "990e9d8b-7eaa-4e60-b5d6-5ace4c1f8af4", "value": "T102C5D003BB8259B1E5CE067961B66B7F4E3A9610D324C9D3CBA12DA5CC312D1673E38D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699546713, "uuid": "a18ee9c5-0a3d-4bb3-ab98-52f08373dcd5", "value": "f25ba11cc2f9d886b0989a9c392d11cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699546713, "uuid": "5095f50c-2d20-4efb-9394-248eeaaab3f7", "value": "49152:921mU+j4kNwzaKPvghxk1CPwDv3uFmAVpzCTJueu+FNRdonOMyDWTEjGmH9g:9218wzakgDk1CPwDv3uFmAVpzybFNRKp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699546713, "uuid": "b32a4a54-5bce-46b3-8594-143b8814bb3c", "value": 2615808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699546713, "uuid": "471ce56b-d7ac-4977-971a-bac241fb04b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699546713, "uuid": "42c70cc2-8730-48d0-a686-eb93fab1e172", "value": "0.9278957684454145.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2973db05-7ecb-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699512153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512153, "uuid": "7ef4c8af-c005-4471-8fa5-c60765d2d548", "comment": "Malware payload", "value": "b686e92241f4b70c16b2ca99831794e3", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512153, "uuid": "27478ed3-123f-4b70-aec7-88e733fa98e1", "comment": "Malware payload", "value": "25e48e16c30bcd004583ce8efebc95ab732f81538b622ef056295514c7a5656a", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512153, "uuid": "71312037-1820-404e-a559-3e0776f6a86b", "comment": "Malware payload", "value": "ec87ec62fb57bb6ac23e8d8ce336c0f781895649", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512153, "uuid": "59bdea17-0847-4bff-adf2-669abbe69ab2", "comment": "Malware payload", "value": "b390b6d181bb236f68b0e6f693c0dc6a4af7bd9d0a5c2b716788d2c4d5217e3cc5a7b7372a062641b81d388b43348415", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512153, "uuid": "a9fa15f4-958a-4311-9859-1f9641a27b86", "value": "T118D39407F3936F29D02F0C780076539D4E79ACFB2C19A26761E53DAC7A70590EE1AE49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512153, "uuid": "c7bbf10c-a5c0-47b0-b7f1-07a4d7d76f45", "value": "1536:ItaDMRVNx3mOkx3/VtMmG29fqu7zA9/8GDAlHX0+DQtSxrt/skogUot/gUEAkYUP:IawRVN43RV9Git6I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699512153, "uuid": "7e83fb58-c1de-4476-81fb-6cd529106ea4", "value": 139264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699512153, "uuid": "c35afb8d-8422-4062-86a7-a12130978f8b", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512153, "uuid": "af596b6c-5e7a-4c12-9794-a0cc417f41e1", "value": "Sirishak.NET(Resume). (3).doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5def51eb-7f55-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1699571511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699571511, "uuid": "5a1a8c1a-ba81-4140-85ed-0abca09e76b1", "comment": "Malware payload (Mirai)", "value": "995446cc1ca6947c735b89d95e41159b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699571511, "uuid": "8ddf509e-53af-428a-9a79-fb60e610806f", "comment": "Malware payload (Mirai)", "value": "2711769ddfbecf548132cf74aff0b1ff4f0c202ebd0365da4869617ac6636a4f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699571511, "uuid": "e4e65f5d-def1-442a-973d-ff1a678cbc73", "comment": "Malware payload (Mirai)", "value": "fb0aed045a396a4c5c263ccdf8617116f4f8a02e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699571511, "uuid": "104452aa-8e98-4495-9df9-abb834a54931", "comment": "Malware payload (Mirai)", "value": "18373c5ada28d6f0a9a758573bde8b9850486bc638eeb678d953753bacae511b1bf7c3ae25b0016ac707fad93cfb7c06", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699571511, "uuid": "fca3fbb0-f647-4cbd-b713-f0804c717253", "value": "T145330991B9824E6AC9D513BBBA6E55CE331063E4D2CF7313D8201B543ACA51F0E6BF41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699571511, "uuid": "73ddc63e-dbb9-4791-ad7c-bc78e43897c2", "value": "1536:CM6A0Y6wggbL6DCgz7P7BWy4LpEyT1GaBy21TNA:mxwgKLAC0r7gzLuyT1xs2VN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699571511, "uuid": "ab5ddb0b-3146-4a68-89ca-c360acf4eaf5", "value": 50800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699571511, "uuid": "690e1b94-23a9-43b5-b13a-114be92e9fc3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699571511, "uuid": "ae122918-f3ae-40cc-b3ea-74cec9fc8e86", "value": "995446cc1ca6947c735b89d95e41159b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "216c9d04-7ec9-11ee-8907-42010a9c0042", "comment": "Malware payload (Loki)", "timestamp": 1699511280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699511280, "uuid": "1dc9b2a2-e4a6-4420-a462-4d2654269cf8", "comment": "Malware payload (Loki)", "value": "0782b4b28031e7ba70427d05241b265f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699511280, "uuid": "d92e2748-20ed-4752-90d9-cc0f063fbca9", "comment": "Malware payload (Loki)", "value": "2717bf3e728f1d9efa6d6185aa9c278518a0fecde6b39c33eb476dae5d6d99fa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699511280, "uuid": "a58c20d9-78f0-41a2-b19a-456b5c2d27d4", "comment": "Malware payload (Loki)", "value": "23589ea0a521beb2478d306ad2576a9c43473a45", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699511280, "uuid": "2eeb9e53-7f18-4b41-b67d-7d4164fc27ea", "comment": "Malware payload (Loki)", "value": "5bbe2d82a0b6be9d09cfb3c0ea2c1f27241e0417020b99b09b5b950e23213db7db7cb139e7712ea3b708c5ec9e76f69a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699511280, "uuid": "822d23db-e5f0-4a8b-8ef8-e60b1200492d", "value": "T13E74BDAC726032EEC867D472DEA81CA4AA60757B931F9257A01715EDEE0C957CF180F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699511280, "uuid": "0bf46c27-0c78-47d0-9406-3d954afb4e87", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699511280, "uuid": "f65b19f5-fff0-46c7-aa65-03eca85af743", "value": "6144:y2/BhX2qwh8rzsmslcwnpOzWLTDJPo1g5Zcgad3dI/M7HihkJHGe+zdfxKjExPs3:5j2vhTm1wsz6JugsdNIE+kJmv5fx2Qs3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699511280, "uuid": "c019ded2-8d67-46b9-b255-8d613eedce95", "value": 367616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699511280, "uuid": "d966ff43-b2aa-43b9-a4a6-89883af64946", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699511280, "uuid": "26983a39-9239-444f-9eca-8bbb5af698c1", "value": "0782b4b28031e7ba70427d05241b265f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d15d491c-7ef0-11ee-8907-42010a9c0042", "comment": "Malware payload (Loki)", "timestamp": 1699528326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528326, "uuid": "5df411fb-671e-4125-80f1-ac071eec7d8b", "comment": "Malware payload (Loki)", "value": "f34f39015fa4a217889205c7cdb9c848", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528326, "uuid": "42052a2e-3a94-47d4-8924-3e62f4d633ff", "comment": "Malware payload (Loki)", "value": "27674f31dc81d861acd4fe029f9fe7329944f0303d41963023987e76d03d15cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528326, "uuid": "d31e6d7e-9e50-4b5f-8a57-d5bcd0b470b5", "comment": "Malware payload (Loki)", "value": "e09a66902934bfdf4e5dc75642fc73bdb56db656", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528326, "uuid": "42486cbc-281a-4a92-a7c8-c6a08ab2d9d5", "comment": "Malware payload (Loki)", "value": "e58e20891a7b8b7cc6780c4775a39712caccf5ca9c06e1b5b3fd73e0f1493f23fe11e921bc774d008c02f9a05515a949", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528326, "uuid": "406af7dc-d208-4510-a974-9e38437d7c03", "value": "T158A4128FA34A8255E1EE4BF908F5D64413B4F6662560EB8AC8CDF1E48C5A7C0680D7DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528326, "uuid": "889df493-d480-4db6-a55b-0b349edc109f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528326, "uuid": "bb558c09-91e0-4e61-84e8-e3f58482fecd", "value": "12288:yJoORMHZAURiqf7sVV5FwZucpUfzIuwY/vkk5o:Qo8M5xRf8V5FyNqfzIN+vkk5o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699528326, "uuid": "202b8a0f-d22d-43f3-8d51-569b62f95924", "value": 487424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699528326, "uuid": "c16da3e3-88c2-444a-84c4-220342d8699f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528326, "uuid": "fbdc2ebc-92b5-4d05-90cb-d3a1414b8a31", "value": "INV# NVB42020.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feb2f36c-7ecc-11ee-8907-42010a9c0042", "comment": "Malware payload (PureCrypter)", "timestamp": 1699512940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512940, "uuid": "3dc7acdf-d587-45ec-afbd-1803d1ca541b", "comment": "Malware payload (PureCrypter)", "value": "2a0585e1c671f80d78dcd8869f872c2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512940, "uuid": "82c2633b-1ae8-4d2c-9544-2305cf3a5fe4", "comment": "Malware payload (PureCrypter)", "value": "27ae678331b50de3e006cc7d419a7e62d7c47e0ac83f84969f66e5670c5dce07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512940, "uuid": "3d17dd64-c63a-49ba-828f-8ca6e04a3845", "comment": "Malware payload (PureCrypter)", "value": "8755cc39f2d3e6db6d20a4c65ec848c88f04bcb0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512940, "uuid": "9cfdf6f8-9c1c-4607-9052-2b57d7d04dbe", "comment": "Malware payload (PureCrypter)", "value": "004d31d7e2d1e153bd62a24f355ad14598dcaa40040331c9f577d835fbd39afa2a51dcadf227e6b34a7afb5496702576", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512940, "uuid": "38e3f763-f060-41a2-b9a6-ad6dc1608319", "value": "T1A152F9445BACD6A3D86B17FD8CB787622A2AF6129805EF0B35C873477D03722243671B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512940, "uuid": "ceaaa736-bce0-4748-9124-35a88c369618", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512940, "uuid": "e803c931-5114-4d66-982a-0233bc6df4b5", "value": "384:YZ+ysEUGhZ88kXN3eXiiay9ycyrsR2vZk:YcyRHcKycyrsR2vZk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699512940, "uuid": "99f2fd3e-12c7-4842-bcfd-a22b97b09fd6", "value": 13824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699512940, "uuid": "20f2e85b-a7f9-4f62-9a46-cb7da1602b3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512940, "uuid": "384a953c-7465-4cdc-a76d-23d2e61d30aa", "value": "Product Requirement2.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9428cb87-7f3f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699562154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699562154, "uuid": "e2bea1eb-2b50-4d9f-bcd6-91411f8ec059", "comment": "Malware payload", "value": "0d0c437a39787127fc0fbf19efc747ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699562154, "uuid": "100ce85b-792d-4c9d-8a31-f8241f5b9d07", "comment": "Malware payload", "value": "27cf4848088b45264379c1a159505baa8f028780aa9965a0e309a98f801c6dde", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699562154, "uuid": "b8f5d1ff-ce04-4ed6-8a5b-eb21387cca33", "comment": "Malware payload", "value": "c3c213acde76e11c968833685c0168719a096bb6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699562154, "uuid": "ca92b38e-7a4b-4363-a8ea-597ba5cb2cf3", "comment": "Malware payload", "value": "2b84d50ecc13ebe179ad65085cdad5b61bf68630ae5d397f65243c835aec4c5fd1dbace9808aa7b4d3c3aaaf25dc249a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699562154, "uuid": "add7eeea-1d1c-4c5a-b6b3-bc16a35bb363", "value": "T170C5AE13F6555DA8E2C39B338F99BE2E35118E324B2AC71A05BC633B751213B6E13578", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699562154, "uuid": "a78d9d6e-63e9-424e-a449-ec65b3951eb5", "value": "162b3f168246672b947871599296b794", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699562154, "uuid": "766acdc6-5136-42ee-89b7-52cbcbb800f6", "value": "49152:2EDR7fB46PaKsbem2+6yWtwFdTHPN9UYH2C2SuikZrxpNrfDRsD:2KR7B460j96yWtwTTHr9uikFzpD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699562154, "uuid": "95ad62be-0fd7-4262-9e6c-e070736e31ce", "value": 2580480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699562154, "uuid": "ba6e7fb0-429d-49eb-803c-b53a2f581d46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699562154, "uuid": "b9cc66e8-521c-4df3-ad20-2d001e3f07d3", "value": "27cf4848088b45264379c1a159505baa8f028780aa9965a0e309a98f801c6dde", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee3ab8de-7f42-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699563593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699563593, "uuid": "64b54527-ba10-4ad2-941d-981396970bd9", "comment": "Malware payload (RedLineStealer)", "value": "a5a37dbf68a7dc0698d89bd890957bad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699563593, "uuid": "27a369cb-90e9-4e3b-a526-ba427640c2d7", "comment": "Malware payload (RedLineStealer)", "value": "28632e6e159d1429a42d13b41801762d0e402bd2534a37ea547d6a12054d6151", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699563593, "uuid": "ecf1d273-872f-4c90-8615-07899663b8c6", "comment": "Malware payload (RedLineStealer)", "value": "fd87d30daadf2e5f46e4e86e1dba7a8067787d56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699563593, "uuid": "475ef113-cc9d-47fc-b06e-58ba7c86028e", "comment": "Malware payload (RedLineStealer)", "value": "9fd09165e2e430ed2f7492730365e62e04c6dd33c4eb55ea5698ec9b7adba5d73ab73ff7f9612aa8c994f7c01aa71265", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699563593, "uuid": "8ca1339e-d5f0-45cb-a911-0cdc4ee3b9b4", "value": "T1C3B41263BBD58472E8B527B014FB03D31F36BDA1A879935B27429D8B0CB2580A476377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699563593, "uuid": "f999d33b-e5cd-4431-8354-5790b647cbdc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699563593, "uuid": "b50637a5-a721-4419-a36a-5d0f2377a5b3", "value": "12288:AMrby90v3fCeHaoe2bmTe/gs981kUd8syLn35kPmpZk6t0roU1d:LyQ3qe6WbEe/gs98VyrJTvR0z1d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699563593, "uuid": "50e291ef-8cae-4aa1-ab47-c47f7152115c", "value": 523264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699563593, "uuid": "4fa0b287-86bd-4c2f-89b5-20962cb98a29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699563593, "uuid": "99d91bdb-8579-4da7-90f0-623d073275da", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f21c5130-7ecc-11ee-8907-42010a9c0042", "comment": "Malware payload (PureCrypter)", "timestamp": 1699512919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512919, "uuid": "fbf41a58-093a-439b-9d19-798bacdbf804", "comment": "Malware payload (PureCrypter)", "value": "cf0309aed683329214501723d893eac6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512919, "uuid": "95241783-3dad-48d2-bb07-4cc9699ee0b1", "comment": "Malware payload (PureCrypter)", "value": "2971d1f4d17492c640f9a0fb98386822b03090945d3e31cfd033b1cb5f3dee24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512919, "uuid": "de2571b1-7187-4bb9-a3f9-0cef66186794", "comment": "Malware payload (PureCrypter)", "value": "b7f4c06858958c6cd12affc214f3bf8fb1e1844c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512919, "uuid": "a9e966f6-d679-4fdd-8842-acad12ef5d0b", "comment": "Malware payload (PureCrypter)", "value": "d8e5e59a0f23eb0331b0daea1153d2de2df9322333779c4da9894df3742f037e1fc763652d2037daafebd8eacc77784c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512919, "uuid": "b778aec5-94d5-4b99-8019-0144ea21648d", "value": "T11C6218949A6CCA93CD1F16FCACF747431A70E655A844EF0B39CDB20A2D43612687A34F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512919, "uuid": "f64c55e6-85b3-4f79-b70e-9a60ac869fbf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512919, "uuid": "c67116fe-0273-4b40-902a-2e04988e3af9", "value": "192:wBFSb9VrrxsvJdkUE8KgKOLv4t2EKJ2XWlXZZfiiLX2HS9yxSyrsRt8G3mSF6zv7:8wZAJY8DKOLgMLbiiay9ycyrsR2vZz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699512919, "uuid": "d6b84c74-3be4-40f8-a4fb-2b1d22b31599", "value": 14848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699512919, "uuid": "43127e63-89b0-4638-8781-d9d14b94f21e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512919, "uuid": "89efe9dc-257b-444a-8afb-2a9c2aa9a9b8", "value": "Copy Of ZHS- CM- 9X12VWXPP709.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb87098b-7ecc-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699512935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512935, "uuid": "7a752a77-9a30-4323-b87e-51a073fadddd", "comment": "Malware payload", "value": "562c708c84a879f6a86438a55b09136c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512935, "uuid": "56fa6fcc-1e01-46d3-be91-64c20300f13c", "comment": "Malware payload", "value": "298fda888fc311b33b1efe7fb22bcd44bb95ee19a0699cfddfeca69c70133d44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512935, "uuid": "9fed2d88-cef9-4b89-a562-dea3e87447cd", "comment": "Malware payload", "value": "153bc42b8d10f51f7ec76bb42ef09b2e0c14a0ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512935, "uuid": "393d9952-1a10-4652-a41d-944e3c7f84e5", "comment": "Malware payload", "value": "d8faab968c5ffcb6f33f0dc230c39f27c001b4a13ebbc03e262d5206f0e0b489c6184622f35dbd929fcaaf6307cce481", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512935, "uuid": "8d32f640-8cd1-4a01-b20a-7bd819f86df2", "value": "T110335D08774CE613C66E1A7D8CF3068447FAA6F7BD02E34BADC4B29819937D2151279B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512935, "uuid": "86b74f94-6ba6-4ad2-a40a-f7256f40d3b6", "value": "1536:qocD7+TARTRso0E1TCav0c9wsfYbhDNovvVW:qocH+TARTR4SFfYbhRoXVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699512935, "uuid": "e0a4208f-2266-4460-9a98-c3dc12089044", "value": 54272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699512935, "uuid": "2d5699d5-2851-4fa7-b105-012d858dda34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512935, "uuid": "275d39a8-5284-4440-bffb-e842fc55a72a", "value": "Design Request - A.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ba70871-7ece-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699513391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513391, "uuid": "4ef6cbb2-7472-4fb4-b73c-5f2341785ccc", "comment": "Malware payload (AgentTesla)", "value": "ab7e3c7fcb24306e81d46e2fc986283e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513391, "uuid": "9583c188-e199-4ddf-8726-488f2fdd34ad", "comment": "Malware payload (AgentTesla)", "value": "2a65dec0d11d538441f4b9e7873ad4b21c48dbc78442c86246ea513ca0311a25", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513391, "uuid": "8a030385-a3b1-4934-a40e-d0fc35adcc15", "comment": "Malware payload (AgentTesla)", "value": "90d9c6c2b903be2c2c69759a96c70620fb88043f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513391, "uuid": "a22c990b-1fe3-4fef-a32a-d0c83fd27d1a", "comment": "Malware payload (AgentTesla)", "value": "d71cebe7329c6fa71b64f442cc389b4d1c9d1325f53420bc9935dfeba764b893cc39ca6765fd933d3fec79cf8909131b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513391, "uuid": "57368a45-d767-40da-81e5-3e0219c9957d", "value": "T174051942B375F82ADA34C1B620E2B944C3E78DD4C6E581753644B9EF673227CABB3146", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513391, "uuid": "feddb9f3-4adf-4816-8b43-00269c6b80bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513391, "uuid": "2a9fb0c3-7e48-4ccf-a8c8-163fd5c4c144", "value": "6144:waZoGRN3/Lq6iuafKEyxz4oG+RwMBKw1b0GoJZnUX62HmkN0l9kv+a+0gM6aMy:wK3/LqhxyyV+Nb0GoUX6SOA+a+BJaZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699513391, "uuid": "8caaf261-0e94-4b74-b8d6-591ac5852ac4", "value": 809472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699513391, "uuid": "c88dea1e-a6ac-43cf-b4e1-bb42d3938c17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513391, "uuid": "418bb36c-ad78-41e4-af38-7beb50564721", "value": "ORDER LIST_OCT7FIBA00541\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c725d854-7f3a-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1699560092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699560092, "uuid": "185b16f6-7852-44ae-9a01-7038ccb9e382", "comment": "Malware payload (Formbook)", "value": "5f72d86ea23a72ba7f337f27d1aeef6c", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699560092, "uuid": "c0967e33-d007-4dab-831e-705404f9816f", "comment": "Malware payload (Formbook)", "value": "2a692d9cd00af372a17a9a50d8bccac5f2475d87d60e5508f8fdd841e79754b1", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699560092, "uuid": "e0b43010-7f0c-4e73-9e74-1611e11490d1", "comment": "Malware payload (Formbook)", "value": "3d5b8b90b37db31136d36734656d9070e3555009", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699560092, "uuid": "5ab2da49-2066-45ec-a5cc-c2eee2c6dd9f", "comment": "Malware payload (Formbook)", "value": "28a0477169491cab2c8152665013582f21711cff21af38955223eb9a2f57c0dff452c4084fa51155c474693aaf40d6e6", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699560092, "uuid": "387a644f-56a7-4c68-a7e0-65da361c645f", "value": "T19BD433462A0F048F724CB30CB673D2D7D3D045D806A399B664F4992D9C2F98689F7A5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699560092, "uuid": "f15c68ca-1b5b-49ac-9f51-8f1efd0d83dd", "value": "12288:488on8usIocdkr4f0/06qXZYH2zZBb+Q6VXY3e4bGe24HUih:488FcCJ2YWzZJ+Qg94bGNfY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699560092, "uuid": "9bbfecba-0352-4371-a39f-ffe6f592a66b", "value": 608058, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699560092, "uuid": "6256cde0-9d8b-4b1b-8558-1413b376cdd3", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699560092, "uuid": "0d017f38-e599-439e-ab6f-420c1a17d8a9", "value": "INVOICE#20231025.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04d23db7-7ece-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699513380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513380, "uuid": "4e81f887-7cd7-4a6e-a861-4f56de3fefea", "comment": "Malware payload (AgentTesla)", "value": "bc2471113b53e9c187de19178656d93b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513380, "uuid": "a5bd9234-0bd4-4d89-a000-6e09adf1a634", "comment": "Malware payload (AgentTesla)", "value": "2abf88086c88ec538403aaaf274e992ab8492f2402f5523f3d212e84c30f3c07", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513380, "uuid": "794439be-e4e1-4919-be65-ec7553a234c2", "comment": "Malware payload (AgentTesla)", "value": "17e054ef11003858d6bccf20bd0410a993cfa1cb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513380, "uuid": "63d56a8c-7dbe-4801-b3e0-c3f6e1fad8df", "comment": "Malware payload (AgentTesla)", "value": "b99ce3835c95169dc02b302500467dfdacbf7686ff2c4fa53e44b69a29dbae10d7312cb31844c0c554cdae33aee06979", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513380, "uuid": "a5399e93-2279-4ad9-90a8-075d939766ba", "value": "T1E86509037B6E86A2E5489736D5E78C00C3AADD8273ABD60A74493B5507333BE8F27547", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513380, "uuid": "a004e048-ecff-41ff-910c-6d2ae6bb9049", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513380, "uuid": "f67c564e-ce8c-4fb8-968c-d9067b5f7d83", "value": "24576:X9YvrcQAYxkESAul0w7FPzC+nPirVfq8vMso//yjZJ5mNhEIS+XpK:hHYMso0zGNS+Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699513380, "uuid": "45c4063f-d350-4ec4-9cc6-81f730f11614", "value": 1458128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699513380, "uuid": "554699ec-081c-40b6-b1d4-d3b87834c42e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513380, "uuid": "a25637a2-8bd6-458f-add4-fc031d885aaf", "value": "Payment Slip (SWIFT)\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2da8e475-7ef9-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1699531917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699531917, "uuid": "8556fe14-8d7f-4f3c-9dc7-92634be5397f", "comment": "Malware payload (Stealc)", "value": "d7b08f590bbea08b801b634582f25ea5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699531917, "uuid": "e4989382-41c1-40ff-8ade-807c3bc1b398", "comment": "Malware payload (Stealc)", "value": "2af36f8ce1ebb5c0d60151c3efd13a35e24084ede221f0538938e01ce2572d95", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699531917, "uuid": "667a6991-6cbc-4c41-844f-64586fbc3aff", "comment": "Malware payload (Stealc)", "value": "6beeb3f8cd3dc59165c591d6a5a5c5d153587d63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699531917, "uuid": "3fab0b3d-bb39-47ed-90bb-035f75f95519", "comment": "Malware payload (Stealc)", "value": "580c1ff50324552391ee50aeda6162e632d8012fdde0b06e38a750d203d476337025eef23c30c615dda784ae924eb040", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699531917, "uuid": "b68c1380-0042-4f36-9c67-a8f46ef9b5c8", "value": "T1FD445D23D2E16C3AE5274E328E6AC6F86A1EB9614F55379A13F4EE2F09701F1D572301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699531917, "uuid": "35f2f568-5bf7-4101-b8da-460b4ae6282a", "value": "4284d1855063ece17f787eb23700c8e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699531917, "uuid": "468e090a-ed81-40a8-ae36-978cac85c6d3", "value": "3072:h12EWJGxDhnScjVDGk2KTKfpuE1RkR5YkrdMZWg/yFOMx:veJGxDBFVDGRibwgakSO0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699531917, "uuid": "cc531320-0be9-433d-be67-51e7bf2a5d5f", "value": 263168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699531917, "uuid": "fd9f899b-e7cb-4653-b701-c1ed5737cdf9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699531917, "uuid": "49a17e02-c504-419e-a629-4c22d4a22ce7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7772ad39-7f00-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699535047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699535047, "uuid": "2ca8e94f-1368-4ebb-8db6-71a56138db2e", "comment": "Malware payload (AgentTesla)", "value": "992a9d2fc84d164dce782a2a21ef6ca5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699535047, "uuid": "73d5f2d7-b517-40d0-9c71-1c541659008b", "comment": "Malware payload (AgentTesla)", "value": "2bb0e9773b6b530e96cd0967825363c46b6c699e868aa0179f6358366c2609b8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699535047, "uuid": "73996ff9-555a-4607-ac36-acf6fd4f87c1", "comment": "Malware payload (AgentTesla)", "value": "5c01526becf44e720c771e0a5802944100b64f26", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699535047, "uuid": "744ce181-a52a-442a-bb5b-2eba965325a5", "comment": "Malware payload (AgentTesla)", "value": "8b4dded3fa26e5ee937c470decec1641c9807b751780b794e0b68396980b3f9cbec4cb1ae7c8e4d3012be96d9d9cd174", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699535047, "uuid": "2f9c4203-12fd-4399-b72e-ce18132854e9", "value": "T1DD742355B946E9A0243272BC4BF74F106631BB456F53AA9F109FA3D3AE43D4906E330B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699535047, "uuid": "f7781e94-4294-434e-bf73-9cc60a38f84f", "value": "6144:aVX8kmgdAjx4aeTVt9AQoV0bFmNdXbgQIeJZyHS38BQUlvcWV/5CC5ZeEC:0XqyTORMYdLgOZDsrUWV/5rZeEC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699535047, "uuid": "49e2c08b-b026-4560-84a2-9c7147ae53a6", "value": 361133, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699535047, "uuid": "8d96b244-31f2-45f0-9790-b4b36eb072c5", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699535047, "uuid": "920f3898-8ab7-4e4f-9e27-5bab0cffe5f5", "value": "ORDINE OC-327-23_1.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "150d2adb-7ee9-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699525004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699525004, "uuid": "88071d71-12cd-4bc8-88b3-0a1307c89233", "comment": "Malware payload (AgentTesla)", "value": "dfd391754b70a330d483c939b52bbf3c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699525004, "uuid": "ea39032d-96e7-4416-828f-755a3b8e3bb3", "comment": "Malware payload (AgentTesla)", "value": "2bd6f71dc8ed2f3f79f0b492444f7ca99e7fbba12d02208fb980a7b59e237d8e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699525004, "uuid": "8c279302-cfd5-4c77-ba90-1b3fffda58e5", "comment": "Malware payload (AgentTesla)", "value": "9e9ff92c1bc8834081eb733012cbf3e6d4dc6aa3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699525004, "uuid": "2df1459f-f068-4f5a-a67f-2ad6ca716282", "comment": "Malware payload (AgentTesla)", "value": "e0afa7e028fb6d8edf92dc553fc4e0403b41838b4cfe2b6f2c7301ba7b07bf796a6cf570c93b2f3770861ee802bef784", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699525004, "uuid": "bd8b8e99-ad02-4782-b419-1691c83e7163", "value": "T1B0E47B3D59AD163BC2B9DFB58FC6C467F0D4A9AB7151AD78A4D303A64302A46F4C023E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699525004, "uuid": "d394a80d-a616-408a-abad-1dfd31521c22", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699525004, "uuid": "aeb1c292-501b-4d2c-87e1-776e3a90eac4", "value": "12288:CtVSY2kx9Bvn2EkwEu44UqgPo0qLWKpmnAmt6BSkDzxMR/:SVSCxf23wEttqgQ//Unjt6vDzK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699525004, "uuid": "10de551e-1574-4318-a926-b902fb6ad1ca", "value": 709120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699525004, "uuid": "a4b0e1be-9347-427c-bfa5-4f15ee869251", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699525004, "uuid": "508bba6f-18d4-4d35-8e50-44a31f408d14", "value": "SecuriteInfo.com.Trojan.Inject4.59820.8843.9940", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be1081f1-7efa-11ee-8907-42010a9c0042", "comment": "Malware payload (Heodo)", "timestamp": 1699532589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699532589, "uuid": "ef1e7528-d597-49c1-929f-bc579a2aaf39", "comment": "Malware payload (Heodo)", "value": "aad865d9ad5b91be8279f4d3ef172e85", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699532589, "uuid": "54767866-7a0a-4fbd-a657-33f8f586ba4c", "comment": "Malware payload (Heodo)", "value": "2fd433c3ff68507ddbf0ec3e90a6320b35b44c8089504403c457bc9819190a0a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699532589, "uuid": "9b2d3882-57f6-405f-acd3-40281072ae5e", "comment": "Malware payload (Heodo)", "value": "4806adf307cc67e3c5a9639455c9495c828c3652", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699532589, "uuid": "9299b997-6103-457c-8b84-947f8faa4376", "comment": "Malware payload (Heodo)", "value": "671ff9e425735c75bad3304cbc229631f127e187e904d7928e840705b92f6c289b99549b362ff58d18d33b2e1b4adb6d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699532589, "uuid": "cc05104c-c9aa-464a-b48f-53410b59e11f", "value": "T149446D13D2E17D6AE5234F328E7EC6E8261EB9214F557B9A16F4EA2F09701F2D172301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699532589, "uuid": "925d0b2d-3a55-4165-82da-5cd9c3c1b7d7", "value": "4284d1855063ece17f787eb23700c8e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699532589, "uuid": "0f2000f0-4c23-4a4e-907f-e6a0ef66f609", "value": "3072:BSBT+WO8EeC8jHleJz0BqJvm1wrS6icDE0K7FFjkaWVDgRrvy7OMx:scWO8r1HleJzw7iDw7FFj6DvK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699532589, "uuid": "e1145319-6ca7-4bbb-a5b1-81fac798f82c", "value": 269312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699532589, "uuid": "8ddb4bde-b109-4026-a587-286c2a5783b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699532589, "uuid": "f2af5ad5-f8b8-4023-88bc-50cfcc19872e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad71780d-7ef4-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699529984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699529984, "uuid": "1cf19c5d-1771-49f0-a133-ce13db3ad102", "comment": "Malware payload", "value": "e40f309c3f87fc0d8c8bc465ad9ec5f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699529984, "uuid": "98529798-fb2a-494c-8f7f-a27fdb5afaf4", "comment": "Malware payload", "value": "31fb0ac814d2f28abaaf210571a7479f6192a0629e054424d88ca598033dc2f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699529984, "uuid": "1e6446ef-706e-4ef1-bbec-33f8648b2d29", "comment": "Malware payload", "value": "a8c801cbc3496afad1658a107aecb63dcc136a10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699529984, "uuid": "5ce2a5db-4186-4e1a-82ef-f2dc6cb14fc9", "comment": "Malware payload", "value": "d23dcf423691edf5d08ccbdb00cca47ba6545fc78a39c0fc77070ec342776e19662e08a0d8870b675b1bdb8caa7ed052", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699529984, "uuid": "e8c7610f-dc06-47fc-ae69-d9a7644b18bf", "value": "T1D73423982708A6E7DE7C593E03D334486B87AB6B26580AD773C94D94F94D3B3C48B6C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699529984, "uuid": "fcd48d54-ebc9-4ef3-8aa7-45bd1addc46d", "value": "18c89e2ec0a399c68eaedd6551ce71fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699529984, "uuid": "721cddb3-ff20-4e81-a01d-440a80513182", "value": "6144:YSgMtszHZqII6D29m5Mx2wRCmD01tnchV7uEjiJ9XPQy0:YSgMt2HZOW298fwRDD01tch9DiJJPQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699529984, "uuid": "d2fb430e-149a-4f69-8878-c7db771f50ee", "value": 250880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699529984, "uuid": "c2440d28-0e67-439f-a5ef-93f165deda23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699529984, "uuid": "96dc8037-41fe-4978-8936-f6815d9d9c66", "value": "31fb0ac814d2f28abaaf210571a7479f6192a0629e054424d88ca598033dc2f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb095c83-7ef6-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699530892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699530892, "uuid": "9b821265-fa14-4f38-b8d3-c87f49e450af", "comment": "Malware payload", "value": "ebd9479514b86dd9acd44c0a239fefa8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699530892, "uuid": "097fe699-e4b5-4b7b-a186-3f9330f27672", "comment": "Malware payload", "value": "33a9a4e3b05c0b673f6aff1f8f91cfd79f3d2de79e51b2b38590ec86492c0c74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699530892, "uuid": "eb135986-6140-480d-ba90-a6784a4b3549", "comment": "Malware payload", "value": "e5e0ee5dd51ba1323eba7fba062ec3c78daca6d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699530892, "uuid": "e62286ca-22bc-4037-8f88-a029e31f4aa8", "comment": "Malware payload", "value": "1f6c7e9a757dd153689bffe906152765bba07fad6ac3bdb69bd1dc38195e3ba98d2c7ddcb3300fe4eddf0c7999e0d8e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699530892, "uuid": "cb447b03-6c34-4e16-8952-8e691c129804", "value": "T182B26A0573DC4229C7BB8E356C728A6046B8BA555D72CB9C0C9550CB8C73790AB72F7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699530892, "uuid": "52aa88fe-f973-4902-801e-d0dfe8b204b5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699530892, "uuid": "078a7a9f-a776-412a-9470-b167db85f89e", "value": "768:Y/YbCpmRdBoUyxpC7/P0iYQMTvVb64nh:KACpmNeW/P0iYbTvVb64h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699530892, "uuid": "dea6e02d-eec6-41bd-ae35-89775bfe7f18", "value": 25600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699530892, "uuid": "df7f0be2-0e7c-4942-9c8d-c54b094dc40b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699530892, "uuid": "77437ce2-04b5-45cc-a103-c0092df36241", "value": "33a9a4e3b05c0b673f6aff1f8f91cfd79f3d2de79e51b2b38590ec86492c0c74", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31f4e12b-7f0d-11ee-8907-42010a9c0042", "comment": "Malware payload (N-W0rm)", "timestamp": 1699540514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699540514, "uuid": "1b8db109-ccc6-4f06-9083-9380598cd2f4", "comment": "Malware payload (N-W0rm)", "value": "b1078270ce5eebc5e3b6fb6d1f513079", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699540514, "uuid": "bcf68135-40c6-41d9-be8c-837dad822b1f", "comment": "Malware payload (N-W0rm)", "value": "34e8f89b08f8eb1ed0a72f0cc584bcc816ed56338ec8164c9f303fb53bb89cf5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699540514, "uuid": "1df566c6-78bf-4c18-81a0-c34a821984d6", "comment": "Malware payload (N-W0rm)", "value": "3534664a3dad4df60454206bdf5e873f42e067cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699540514, "uuid": "fb0126c0-ea4c-44cb-a742-503cdf685aed", "comment": "Malware payload (N-W0rm)", "value": "20e3bf524ef00f2f244212e207c682a5168099b1bac70aac826b508317e15b6d01487e5f0aab0f2917801778abd15cc3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699540514, "uuid": "ecbcead0-1535-4074-b14e-d9226abc7936", "value": "T13DD423B103DEAC2AEA5195304D708CFD183AE3FE3D2184519318F14B6F2F7966A6239D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699540514, "uuid": "7032797e-810f-4e8b-9f64-1ea1fca53e26", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699540514, "uuid": "446c2daf-4268-4a62-8f24-97d607fe1571", "value": "12288:pJ5rgrJE86MfUOYAjZ0rcbk/7XpQmS4L50xPSLyevCmMKy7pbQ2FB1Of4mzvTFhC:X5R8PuiZOcIDf56S5vCa4pbQWCftv+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699540514, "uuid": "242ea67c-ddb3-4193-a70b-ccb17c49b604", "value": 606208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699540514, "uuid": "e0d87e52-487a-4d86-84dd-7e30b67be759", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699540514, "uuid": "02783db2-87e2-4185-aa95-66f035c146b9", "value": "b1078270ce5eebc5e3b6fb6d1f513079.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb698b63-7ecc-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699512908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512908, "uuid": "b8a37721-3b1b-426e-9a81-1c8cbd07c49c", "comment": "Malware payload", "value": "047ebab3c23450e432e7b4ac457c4ea8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512908, "uuid": "a198d61a-1469-44ee-93e9-97fcd5ee3d67", "comment": "Malware payload", "value": "37e64d9178c73444d42f82a228fc822900d1d0ebffc99919d281b2416c9b6033", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512908, "uuid": "f5dfb86c-e41c-4b16-abbb-be5975b226b7", "comment": "Malware payload", "value": "c87f007c62fabe16c6ef9b91562a45c533d71f4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512908, "uuid": "fdec2173-67eb-4078-821d-677899d2a041", "comment": "Malware payload", "value": "808276d1be031460c3e72a13a3201eefc4995c6e6ae98c4f44650202ecfb59e951e0d1725d4868506c75980e040a8216", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512908, "uuid": "af3ba29a-a0d0-4b4a-a717-d2cfdcdc333c", "value": "T1F753F847BB5B85F1C24807BEC9EB41C81B64E697B693EB0E358E23551B537EA880C50F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512908, "uuid": "f61b1d69-153f-43a9-9474-92d9245c007e", "value": "1536:6HubbmZNkU+yBfozHnaOrSjh8LrQh8mr1vvM:6HBNSyB0fA8XCr1XM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699512908, "uuid": "987cece8-2d50-422e-b018-a2e83407b30d", "value": 60928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699512908, "uuid": "0e6e1804-34f0-43ee-8811-b32f9cae7525", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512908, "uuid": "e063b204-a863-42d1-9568-c4482d146afc", "value": "Item Design 367828.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "241885ab-7f06-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699537484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699537484, "uuid": "015f61fe-72fd-427c-8f15-fd8732a614d1", "comment": "Malware payload", "value": "52bab78beb793be5f2f49e407d49d87a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699537484, "uuid": "fb15a6f7-d9c9-48b2-8fe4-19dac8174638", "comment": "Malware payload", "value": "38ec5a681beecabf8fb1fccc66858c0f194b8fe3e5fbc5202cd6ca480f8eb4e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699537484, "uuid": "b17d0702-352a-4b3e-bebe-4144481a14da", "comment": "Malware payload", "value": "28606fe8ebae84a089ec0f80b391f9ded468cfac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699537484, "uuid": "db147297-e54e-4f6c-a78f-a0b246f7ec6c", "comment": "Malware payload", "value": "1fd481104c736fd48ff57f2134cf5b603e9d0327cdf60904e1e3e4d5c385e3630bf06b708ade115cc513915f57bf4e9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699537484, "uuid": "d1e6b1e6-0938-4c70-b8c9-bbf9b8514ffb", "value": "T1B0958D02B6C280B2D9C214B572AE7FB95D786F301731A4C793C83D658A74DD2763AE1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699537484, "uuid": "2303acc7-5de7-4ae1-a302-b0ceb8e64f24", "value": "5348a92b27e6dcaee7fd93f60a339106", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699537484, "uuid": "3b83416e-f36e-44c0-a120-b9253758e5b7", "value": "49152:W0pJy5D4ySeds/kflISsk+Vo1DtAxWCM7p+P6PmjkEHUMbZm:WEJDdeds8flIbwCM7C6F4w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699537484, "uuid": "aa9b1638-d9ec-45e0-8b51-0c4b8c8334c6", "value": 1885544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699537484, "uuid": "717a08f0-1854-4c19-8f50-d06f1a7b9eee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699537484, "uuid": "cb166b76-2a52-424f-965e-0e63eb386bb0", "value": "38ec5a681beecabf8fb1fccc66858c0f194b8fe3e5fbc5202cd6ca480f8eb4e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1c9c85f-7ecd-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699513348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513348, "uuid": "64b9b269-1a98-4866-8ae8-e2ef22f846a9", "comment": "Malware payload (AgentTesla)", "value": "2ecde138c6caff769594578e1aa2b8ad", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513348, "uuid": "ccacf8d5-0ec4-46b0-91dd-96be38ea4165", "comment": "Malware payload (AgentTesla)", "value": "3a20b07d424cd7da1386f2ac0491005b763d756255f80df2b3f09d18ff8c09a8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513348, "uuid": "bff26b3e-0d02-4287-a945-2f8b69e35c4c", "comment": "Malware payload (AgentTesla)", "value": "c918abfa17e271ac40c8dfa835bcb8901e8a397b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513348, "uuid": "d09a3f63-3f9c-4fea-8b08-83b13b46d68e", "comment": "Malware payload (AgentTesla)", "value": "811da687033dbddd860dbe9f8fb68e2e727f3b2ce661d5e95078408695526ff9eb541eb7c5b1b0cf4874622b3ffc30ee", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513348, "uuid": "62d1b70e-ac12-4e57-823b-afb096012388", "value": "T148256C1837785562CA5ECB3484D29908EAE3CE2E57D5974E1840B6B99E333FDDB038D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513348, "uuid": "dcc70c33-1228-4582-a28d-1b3a9af071ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513348, "uuid": "c852d2d4-63ad-4a85-bdaa-ea408dd9bd4b", "value": "12288:ErMTajdNnecbx1ir4afxU/I7vaBzGvHlMiKDXvJ1ij:Maarnp9qJdNMiKTJ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699513348, "uuid": "d609e1df-d7d6-4280-bd73-39062acfc83e", "value": 974336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699513348, "uuid": "a67125d7-716a-4e38-a159-1f12216be15c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513348, "uuid": "bf955a1d-fafa-439f-a7fe-af0e356ba66e", "value": "Payment Slip (SWIFT)\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "506ddd03-7ef1-11ee-8907-42010a9c0042", "comment": "Malware payload (Nivdort)", "timestamp": 1699528539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528539, "uuid": "70e90813-b9f3-4497-b5ab-5a2cc1487c11", "comment": "Malware payload (Nivdort)", "value": "7662eaff0fe8cfbda82be2793b160494", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nivdort", "colour": "#21A77E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528539, "uuid": "be6dacbd-0957-4534-bd4f-80e5c5c77f50", "comment": "Malware payload (Nivdort)", "value": "3a24cd0b241ca737061f9b05cc186bd39e9f434fc146fbad4482bd34d267b5ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nivdort", "colour": "#21A77E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528539, "uuid": "35bd5c8e-827e-4aef-b60c-f2e6b4153868", "comment": "Malware payload (Nivdort)", "value": "6ba617b3474341919ee62b4f5d948bd50ba0dea5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nivdort", "colour": "#21A77E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528539, "uuid": "743f4efe-728a-41f4-985c-10f4b0f82bd8", "comment": "Malware payload (Nivdort)", "value": "d60db1661f68e386747dd345e98fca117a0906aa3b337762074d533f4860b4de9c498e40e614ca702a7a704aabdc8bd0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nivdort", "colour": "#21A77E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528539, "uuid": "07f24bad-8baf-4925-928e-225180dcf00f", "value": "T18BD48100970C0215ECE33DB8403176FAFAF96D5097A36AA2F2FD09BC7D28A5C5799749", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528539, "uuid": "8be4c5dd-a169-4b89-a92d-564b9a821457", "value": "03fd256f19b91942d44aab76f62baff3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528539, "uuid": "fa9c0f4c-9b19-4033-96e6-b41dd633230d", "value": "12288:DauIwKjOBdMzNxLrikUZ21EOgJvRFZSjBCFZ7nhHC:TI2B8xeO1EfJvlSjgL7hi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699528539, "uuid": "015f5d2c-0dac-4ead-b67e-94d7128ceade", "value": 615424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699528539, "uuid": "eeb951d0-4461-428b-8351-83e88d791a22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528539, "uuid": "b6626917-3f45-4a99-9f93-1ef4f24cbf16", "value": "3a24cd0b241ca737061f9b05cc186bd39e9f434fc146fbad4482bd34d267b5ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "418793c9-7ec2-11ee-8907-42010a9c0042", "comment": "Malware payload (MarsStealer)", "timestamp": 1699508328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699508328, "uuid": "d1866b78-7cce-414d-9cd9-8c72eaa2f143", "comment": "Malware payload (MarsStealer)", "value": "442b07a92fd3a3136c182f79f4fa25ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699508328, "uuid": "2fc16f3f-213a-432a-9f85-d5d3532e3f56", "comment": "Malware payload (MarsStealer)", "value": "3a4832a27115044282cf88cbd4dc743017b7ef106670472f05b8034cb7d81d9c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699508328, "uuid": "e7a12058-a3e1-4a0d-a557-808e1279a258", "comment": "Malware payload (MarsStealer)", "value": "3064535915079b8d33382f7ffe36af2b391188a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699508328, "uuid": "6aefdc30-8128-4b65-be47-ba70bdbe5d27", "comment": "Malware payload (MarsStealer)", "value": "557892af399e0b69225fd475ca275cd424df3c963ae98f8b1c46f8fc0afd2a24acf924cad704a531fbee8ec5d633ade4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699508328, "uuid": "8ef502fe-593b-489e-ab9c-408cd8e9e111", "value": "T1E764094352E63D55EA66CB328E2EF6F8771DF9518F0BB7A61218AB1F04B01B3C162711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699508328, "uuid": "adab0883-d30a-48ef-8f07-2e2dd121770c", "value": "57519cfdcbd88efd3d27319b294f8249", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699508328, "uuid": "c410b989-e077-498e-a36d-debf587dae78", "value": "3072:2//1Zfw4+GTrsj26e8wqM/Cj8vrb+dkHbTakW19Xk4Dh9wAAHsFz:6Zfw4+s+26euMagvrKubTa3D/gH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699508328, "uuid": "d9c15833-8427-439d-ab27-c9c9fd70c052", "value": 325632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699508328, "uuid": "dfba7d75-044d-4770-823f-da8b614cc4db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699508328, "uuid": "20569f14-d675-45a5-a9fd-5de8718c6850", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf7bf9e6-7ef0-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699528323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528323, "uuid": "dd7d36b9-16f5-4949-8172-32b94e274c6d", "comment": "Malware payload (AgentTesla)", "value": "2c3fd5b761bfa417b03b80524126e55d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528323, "uuid": "926a27fe-8833-4458-96e4-2efe4f2159ab", "comment": "Malware payload (AgentTesla)", "value": "3abc55d444c9f395cbfb42fdeded0fd6947de482fbb4fb40da2b328aad7bd194", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528323, "uuid": "2980fe9c-0eed-4385-9071-2311248cfbd0", "comment": "Malware payload (AgentTesla)", "value": "3b53eb498f323a2376ff4f48ddff175c1eb654ea", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528323, "uuid": "0659a331-fc6d-456c-882a-c10af9f13970", "comment": "Malware payload (AgentTesla)", "value": "ce2f17800fb0352d44742a46977caa6f2a0dfb8f785565bac23eab9eece7384c5489b0eb60cc6b052f5b7b8aafe16509", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528323, "uuid": "752fb7dd-70a0-4a13-a1f6-6f232932509e", "value": "T145F4D021227E9FA7D97B53F48550444443F1AA5D657FE31A4DC2B0DFAAEAF400A82F23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528323, "uuid": "0dc0698d-d642-4bd0-a865-444662d424ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528323, "uuid": "05f3f4b5-232f-4ed8-aa43-bfe17850ab59", "value": "12288:6VpB7GBEG9+oR21qayB/5AHvdr9iEht3W6uuSC9PNv5S1cBuVzpmu8qF9cU1YT:pt21qlBBAHvdrJL3W3C5S1cru8St1YT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699528323, "uuid": "662ac4c1-f7be-4735-90a2-33d9f98787ac", "value": 793088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699528323, "uuid": "12f8c21e-dcdb-413c-8712-c68cf578fc0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528323, "uuid": "aaac5fab-ec6d-40f0-b38b-71f25a08eb1e", "value": "consulta de pre\u00e7os.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36b36891-7ecc-11ee-8907-42010a9c0042", "comment": "Malware payload (DBatLoader)", "timestamp": 1699512605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512605, "uuid": "91703418-9053-419c-8cb0-d0d477c51d26", "comment": "Malware payload (DBatLoader)", "value": "593a9b2f5ee977e62c6153c638d6b067", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512605, "uuid": "b5ee3044-bb10-4fcf-984a-83895ea01c8f", "comment": "Malware payload (DBatLoader)", "value": "3ba6ce638dcb1c82a2d3096edcc46a1d5086b9233c4e8be471ba748af9d9b41a", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512605, "uuid": "0aee9fc4-734a-4861-a380-95fc554e003f", "comment": "Malware payload (DBatLoader)", "value": "9b390448b43960e12b02e0c2c1c5f34b21ea0c5a", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512605, "uuid": "64884f78-1a39-4c49-8a47-249101625e5f", "comment": "Malware payload (DBatLoader)", "value": "d19cf764e5c8588f8805fd5a74a00e197124cf54d29fd52f5cdd4e6fb4d5f2ae54b24c553fd6318beaf3a0be56c3d531", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512605, "uuid": "00498ea5-dae2-4476-b14a-ce0f94b453a4", "value": "T1E265E166B1664077C0232A74DCCE92B4B819BD306F7CE85E25E809BD9FE3784247D693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512605, "uuid": "2a8b19a6-7836-4ed8-a6f0-7e59cfe8eda6", "value": "60f6ac6f53d8290345a6172546c7a045", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512605, "uuid": "fc6d79c4-7e87-413f-a7b4-d437122f3800", "value": "24576:a1gIhzVfFATn5p6hEj9mdvc/R/hntYbVwypYhSJt4ouqiFaa/A:a1hVCOdcTntYZwyueGoS4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699512605, "uuid": "84dac21b-5acf-420c-ba97-ff79d21bc670", "value": 1494528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699512605, "uuid": "04d05d14-0844-4fb0-9e32-5856513fbd64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512605, "uuid": "80e97bad-f7a8-448e-bb8a-8ca132a1b4c7", "value": "Sars Tax Refund.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75e7b307-7f00-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699535044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699535044, "uuid": "79c67ef1-f2ec-4302-9fe8-1b9ed8063c00", "comment": "Malware payload", "value": "44cc8bb84036012178abc1cb254174f1", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699535044, "uuid": "1e49a21b-d46d-4963-bd7c-327cfa1d4d7f", "comment": "Malware payload", "value": "3c88795ae0319e90dc049fa8027b65c9d1e28544a341e0791a178aacec1c50c2", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699535044, "uuid": "b39b15f5-254e-406d-ac94-9f3cd1d2a4dd", "comment": "Malware payload", "value": "fca7d6bbbd81f136e5c24b6f78e0874e0eb0726a", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699535044, "uuid": "6e79ebc8-2183-4558-a184-f18245a6f36a", "comment": "Malware payload", "value": "3958ee758900a855fb3525e3be33cc821c3a6523204fe3363a1fdf20590bae962a9e704104b89c990e0e2d35187ff96d", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699535044, "uuid": "c6149043-1c5a-49d5-a317-fb7e8efd5e0b", "value": "T11D14237C48554073C89F04F6C9B61ABAEE92BC6A81F217962D13D608C5983CEBF5C17D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699535044, "uuid": "1b10135e-1aad-4f46-b5d8-16d418b3f828", "value": "3072:g3qbr12nuy5pqp95wIsK7DnWTavz6+OV4Qaw03hklfN6d6sQMD7uiFFDtMHHnRYZ:+qbr1Smn17Dr76+G4xw0uUd6ssaA3K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699535044, "uuid": "7382f50d-64e6-4a31-bcdc-811fed021df7", "value": 196552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699535044, "uuid": "d0be4ec1-5af1-4c29-beec-e47f07d62b06", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699535044, "uuid": "b4857770-57c4-4c8d-b746-db9a979ea85d", "value": "Label-4800014530.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2682e0c-7f37-11ee-8907-42010a9c0042", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1699558822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699558822, "uuid": "a1fd6345-8088-4adb-8c82-450f25e37e6d", "comment": "Malware payload (Adware.Neoreklami)", "value": "bc2515aa503c83d26f04ff02f73052e4", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699558822, "uuid": "fdbc7b92-d3ee-4718-b6e0-5f636f948626", "comment": "Malware payload (Adware.Neoreklami)", "value": "3cd9baddf9c94a586bd23e7545791ed2bdcc9ff3118a800fcce9996af9905bee", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699558822, "uuid": "b8c34d4d-f8e3-484e-99af-23d813e2cad3", "comment": "Malware payload (Adware.Neoreklami)", "value": "93bad067566f65a612cf8a7cab4e9f7389d4d70f", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699558822, "uuid": "5cdb23da-e8aa-4e7f-9bcd-f996c78a57bb", "comment": "Malware payload (Adware.Neoreklami)", "value": "15f8a281499a1ac5aca861cc0eab1e2e79b0e097ce30bea40b44dbab110a9aea5b37f5daf16a2053f1fbd9c77b007eb3", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699558822, "uuid": "6cee977f-8210-4753-a5d5-ff27f74bdae2", "value": "T115763317F5E0C4BAF5D0023082A2A3E567B4DD4A877441EB3BC34AFD5EF2896C54B52A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699558822, "uuid": "6dd9f4da-c8b4-4519-9fb2-041c5e0f8311", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699558822, "uuid": "d4071d35-3424-4328-bc84-a8ebd6d09b56", "value": "196608:91O7/A4irL4LQyltMqTyma2/AddAfq2/9+Zh1waeg4:3Ok4iXi3l5yma3yubug4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699558822, "uuid": "1fdf3c79-e91e-400a-a63a-fe05b3f86e1e", "value": 7490385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699558822, "uuid": "f7d4e27d-a94d-4d33-9f0c-fdd8cdf05426", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699558822, "uuid": "c7fe1417-42b4-4e78-b863-41b75268f0f4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ce35351-7f06-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699537472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699537472, "uuid": "e5054556-f441-4590-994b-9c8f0bc7e231", "comment": "Malware payload", "value": "657e9c6c4ff8cf1777776abba9b6f115", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699537472, "uuid": "98ed3ebf-9747-4012-b72a-f49268518861", "comment": "Malware payload", "value": "3e10b37a2bd4f851c72cbb731e8f6622ad598cfb65bcf45c0460373bfb747fa7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699537472, "uuid": "d96f0541-bcfe-448b-b3aa-bcb479be8906", "comment": "Malware payload", "value": "62ce40d7498ebdd9511c7da1cb5d3a4a02904390", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699537472, "uuid": "8973dcc1-3113-4b35-86b1-c6597665a9ec", "comment": "Malware payload", "value": "6e35bc2136f2cfa5befe771625940f3a9572c6ed414aaa477860f05dea2c1bbf359f9e24e537d81f7ccc153abbd462a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699537472, "uuid": "13aad842-bd90-46c5-8d8f-03064275ea55", "value": "T10B847B02B3D3E07AF5A702315A2697295776BE925F338AC37B803A5CDD306D29E35B05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699537472, "uuid": "fa76540f-b2c1-4c24-a4d4-7d01ddd957b8", "value": "1cabadb73e0d3f627a5ead7305e08be6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699537472, "uuid": "95ce2f92-8add-4dc7-8d66-3d850d3947b3", "value": "6144:Oetzmqzm560+UDlNkBMQWzUSZnb2LNL/eWFMHZA/0uFmv:Fzm56ZBMFnyNL/0HZA/Sv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699537472, "uuid": "d2608ffc-8182-4fc5-bb22-beb32d829501", "value": 389120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699537472, "uuid": "ee2758d8-9ec0-4dad-b19d-77a5462bd385", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699537472, "uuid": "2ffe4ebc-8e8e-4a01-84c9-24ef75ed14f9", "value": "3e10b37a2bd4f851c72cbb731e8f6622ad598cfb65bcf45c0460373bfb747fa7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "579c2f1c-7ed5-11ee-8907-42010a9c0042", "comment": "Malware payload (njrat)", "timestamp": 1699516525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699516525, "uuid": "6c1e62e4-f968-4045-b144-10ad2dddf4a6", "comment": "Malware payload (njrat)", "value": "8496b94ce84599e9e16b77729ceb9287", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699516525, "uuid": "5ee46ead-7f30-4c7d-8fce-cf38ab900635", "comment": "Malware payload (njrat)", "value": "405ce89e927ad2d13ab0bfcbdeec61af03454b034f5acfeaa756571f8a15198b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699516525, "uuid": "5d3fc7a8-bfbb-47d1-b0db-c5c6ce693d6b", "comment": "Malware payload (njrat)", "value": "a6d0582c67099889909b5723c3223e72e5d8d835", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699516525, "uuid": "9f61a37c-c421-4f93-84ac-d89574f7c83b", "comment": "Malware payload (njrat)", "value": "b9b2d27aacfb428c38f0acd3ac40935a78810f5bf0907706cf8e28104ebf62f1d1f5423b24c5263b8a98ef4d5cb366c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699516525, "uuid": "0b7203f2-b8b3-436b-98bf-ab78f3b3aca4", "value": "T1E17633104F6D3F56DB28423CB0EF6F1E1BA0BF548009E6D667D564CB265BBC20A0F95A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699516525, "uuid": "9cda6d23-9858-4ff2-bd91-3667cdcc3b14", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699516525, "uuid": "4bf2b50f-8772-4829-8f8a-08c0fb8c5349", "value": "49152:5YNkkqVvgWPKbpuu1rEe11F5w2jg8Hz//b/PxJfTgxxsACljbzRvfTBvZUD3ySqH:5m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699516525, "uuid": "e8f43019-c0bc-41cb-8a90-05a748b8cfa5", "value": 7299550, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699516525, "uuid": "bfe15628-683c-4876-8bd1-6f412a614207", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699516525, "uuid": "3027b625-9508-48ae-ada0-4ded836f01bd", "value": "405CE89E927AD2D13AB0BFCBDEEC61AF03454B034F5AC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fb7b596-7ecd-11ee-8907-42010a9c0042", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1699512996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512996, "uuid": "8af5cd06-1f68-4bef-8c1c-665a6a7ea7cd", "comment": "Malware payload (AveMariaRAT)", "value": "b654cebe75c5ef7192f63ca3bc3b11f0", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512996, "uuid": "71603814-e202-44ab-9a50-126df2d46df1", "comment": "Malware payload (AveMariaRAT)", "value": "4138d92e4af5e1c1b49d654c8a55c5c759261e2d4108c6ef6b4308f9ba8b0355", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512996, "uuid": "39304aa1-ad3f-4f19-94ae-642d9bf10337", "comment": "Malware payload (AveMariaRAT)", "value": "44cb222b665555d6828448fd57d4f874b4bc83de", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512996, "uuid": "6627689e-db1b-4f7e-9f99-1102aa0575ed", "comment": "Malware payload (AveMariaRAT)", "value": "900dd27001dc89c6eefded381cd2ed02a9cb5c0e4d1c268d9cbf82bd7817e9a49f6885104b99b80d40b61710427e4f4b", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512996, "uuid": "0e32d40d-53a9-42c1-88cd-6f92ef6a3caa", "value": "T1BFB42385C3E9E9F6D491C77809BAA9730B8A201605D9AF0E13843DAE7873653D50FB4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512996, "uuid": "ad4e77b9-2b79-40a6-ae02-89a634ae329c", "value": "9dda1a1d1f8a1d13ae0297b47046b26e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512996, "uuid": "94598076-15d0-4e36-8814-b44517828b29", "value": "12288:/nPdcH9wZoZLLZD78RWDSDsuZaSDJGU1jLAiJ:PPdG9wZotZFDZuZzvLAu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699512996, "uuid": "c45669d5-0926-4d9f-8f62-e11ca6b20a9c", "value": 509193, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699512996, "uuid": "8e13fadf-81e8-44dd-a2aa-8fd6b86de325", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512996, "uuid": "b3ef2bbc-c6fe-424c-beaa-df70b403d24a", "value": "XE9986560000000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b4eb58f-7f3c-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699560689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699560689, "uuid": "9d14b243-10f3-46cf-adc6-3e72fad4ba75", "comment": "Malware payload (RedLineStealer)", "value": "45088513a3de76d66715fdf1ad7b4ddf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699560689, "uuid": "58179507-b8ec-4cff-9b3b-acd1c3c9a3e6", "comment": "Malware payload (RedLineStealer)", "value": "4236b17b58ad6b22987c57bfd0b0b264491334bfe78f0e9731adb6bb566e0da6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699560689, "uuid": "9cc33fac-0e5d-44a0-a52f-8fa8734a4bd3", "comment": "Malware payload (RedLineStealer)", "value": "5aecee7ac619da6e9df1ed3c1422e71957ca6de8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699560689, "uuid": "4e96d267-10de-4d97-89b4-8cc3af7bfa21", "comment": "Malware payload (RedLineStealer)", "value": "d88a6824d644891d10b05cbc081ccde9d666afbe63db9f683c606af1e46d2660486d792335a89d811c0fcbfb866326ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699560689, "uuid": "bbb78280-55db-4190-9c17-268007bf970f", "value": "T15AB41213B7EC8033D8F1277058FA02970B36BCA14D7853AB3395A95B49B2684B53677B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699560689, "uuid": "8c82e62f-3c1c-4cf1-839a-99420892602a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699560689, "uuid": "b6ebbf39-ab7d-4868-9580-8ffd39040fdc", "value": "12288:IMrLy90BUApb4W/Hz/HRlR94TcJFf2oxP8iFpP1upgEULds:DyO4IzJlR9NFf2S0iH1uiEwds", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699560689, "uuid": "0df4b6ce-b975-4f24-958d-ad9fb65a09c9", "value": 523264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699560689, "uuid": "c18e83ec-17c6-4fd6-810f-5b3d9837b4d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699560689, "uuid": "75766a3e-b4bd-4fd7-87ee-631790cd2eea", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea2b873a-7f4e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699568740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699568740, "uuid": "b0d9a20b-beba-4278-a432-9f306e614922", "comment": "Malware payload", "value": "dad3f94fcd72258d281cf579a3bc9c14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699568740, "uuid": "2f97a905-cc19-4fe5-bde8-71246421069c", "comment": "Malware payload", "value": "426a7f02f18fbe6bd3502b95ac91ccd6529bfbb930a66999068834009635e5b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699568740, "uuid": "405b4dc8-c5f1-492e-be6e-fe83fd040864", "comment": "Malware payload", "value": "f8d7baf4ff841a34c247ba426eabe06d19ba3361", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699568740, "uuid": "d8f4a7d8-09e3-42d4-8613-b042520be1d4", "comment": "Malware payload", "value": "8dc4f75eecf40253aa7061c4e63a90a8e5fac8f1c957595e57f64180b39d45ed96270a5486879a28c77d62fb9bf0cf5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699568740, "uuid": "b83f7133-953e-41a7-9a93-fffd70334ede", "value": "T150B41242BAD890B2DDB517B158FA02D31E353DE1E979832B378AA81B0CB36D45931737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699568740, "uuid": "f3505945-ff23-4805-8d66-3cd2665a0909", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699568740, "uuid": "f5880f93-2aa0-4aed-a0c1-49dec8cea1f8", "value": "12288:tMrpy90hRm+0SHaf/qwfLD7+Y8TUs2ouP+4+wSRHFLy1u6E:cywRm+0eiQYSz2ou2USNMlE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699568740, "uuid": "514369a4-7366-4fda-9ed3-640a07fd4e45", "value": 523264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699568740, "uuid": "f33b1e62-6302-49d3-bb8f-e32397ab69b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699568740, "uuid": "0da31c25-dd6c-4bbf-ae44-69b5fb95e5a3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b062db2-7f0b-11ee-8907-42010a9c0042", "comment": "Malware payload (zgRAT)", "timestamp": 1699539643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699539643, "uuid": "dbd602c4-cead-41fe-92ba-621ccd09e147", "comment": "Malware payload (zgRAT)", "value": "f24b11c123d64aa70b8d9f777c737e78", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699539643, "uuid": "02e5737d-b628-4b34-9f45-4457ac083a48", "comment": "Malware payload (zgRAT)", "value": "42b9ed0f298f81541b258d52e7ee20957836a779f41092419707c4807a5f6869", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699539643, "uuid": "5cba7631-0908-4efc-b554-5d3fc6741a7a", "comment": "Malware payload (zgRAT)", "value": "6249154fef1bba710cbf4aa99248db1b7dbc7103", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699539643, "uuid": "a6a981a0-5e3e-4d17-9add-af520c3cd7c1", "comment": "Malware payload (zgRAT)", "value": "b57b197131a48817af2af0c5bab059dd18a02dc6d9608919b6c72b45c4866f5b48385b715fda45124a8ef2fecf893d06", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699539643, "uuid": "a0cd0b93-ba1e-4edb-91db-a7b8afb52bcf", "value": "T1206523312FE5CEA503FCB37514D6180C6FA58AC18C4DC2D9CB5308A3487DBA56A5B9BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699539643, "uuid": "c997834d-f797-49b8-8654-bb1e0443f612", "value": "24576:VL2u2gp9mt6lzGWueZnbK8OOfTpKHAIA8tV6/zNHkeVwUVOdavDaCR7J:h2gzJueYdTAA2zNDv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699539643, "uuid": "d4d24ea6-826c-469a-b0c8-d95424c0512b", "value": 1501521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699539643, "uuid": "aacdef61-e1fc-4de7-b350-d639c7e0659b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699539643, "uuid": "30e6502d-23cf-476b-94e2-06224b03ff59", "value": "IMG_690B23.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0df2ef93-7f18-11ee-8907-42010a9c0042", "comment": "Malware payload (DarkGate)", "timestamp": 1699545178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699545178, "uuid": "c9e8e0df-a7b8-4276-85a1-6a6e347beb24", "comment": "Malware payload (DarkGate)", "value": "31d5d8849afd96b36181ddce93d18b7c", "object_relation": "md5", "Tag": [ { "name": "botnet-PLEX", "colour": "#3CFE1A", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699545178, "uuid": "e8b355bf-161c-45a9-bc09-6823af84aa3c", "comment": "Malware payload (DarkGate)", "value": "43502c46c61cda9226a4a375a593037caf07d2e14bea0a5c3be35d0518aacc6f", "object_relation": "sha256", "Tag": [ { "name": "botnet-PLEX", "colour": "#3CFE1A", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699545178, "uuid": "f865a157-34cb-4549-9687-8f21b646693f", "comment": "Malware payload (DarkGate)", "value": "c3d67b907e4adc2ec4e46173b43817498a7e5de7", "object_relation": "sha1", "Tag": [ { "name": "botnet-PLEX", "colour": "#3CFE1A", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699545178, "uuid": "09ae3c2e-e8a2-4f04-819d-f1b85239dc28", "comment": "Malware payload (DarkGate)", "value": "ddfcabd32271f429a72944622cecf9539fcb8272df357a27458f72655c02420bb1158838d622ce8b3b56af04973346fd", "object_relation": "sha3-384", "Tag": [ { "name": "botnet-PLEX", "colour": "#3CFE1A", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699545178, "uuid": "46f22c91-81f4-426d-a5ba-4e194741a903", "value": "T10A43122041AE802CD02A483A48298C3EF866A00EA137CD2082A01AE8A8A78298E48D85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699545178, "uuid": "75227ff0-c233-4368-8bac-f68c938bdddd", "value": "6:HRYFVmQ84uSZPUH8/YlXSoIJ73yYesbBS:HRYFVmQ8VSt/YlXUR39nS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699545178, "uuid": "eedfc489-ab4a-4108-a4ba-e19eef2022d2", "value": 58905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699545178, "uuid": "3880ae8c-9b20-4443-9462-8b760b9c5cdc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699545178, "uuid": "46035f4e-80e3-4a0e-ad09-f10316fd99ba", "value": "s-nov-VKLADZ4631.url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6c306f0-7efc-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699533543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699533543, "uuid": "4b88b77e-cc03-44a5-96e0-1c8e9f8d270f", "comment": "Malware payload (AgentTesla)", "value": "794eb627094d447b06ae43fbc99c1981", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699533543, "uuid": "fd02448d-f2ed-41bf-9511-e64c6cddacb3", "comment": "Malware payload (AgentTesla)", "value": "436c26131eda78a0614870150389dd719a2ca8b1793d57c36ffc5f3d9c757364", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699533543, "uuid": "9bc890c7-2f2a-4215-b3ff-3282c28a534d", "comment": "Malware payload (AgentTesla)", "value": "9d03a5aa9a66b719eff1a7017180bc31f771920e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699533543, "uuid": "1cf2452d-b250-42e0-9b68-e97708b039f8", "comment": "Malware payload (AgentTesla)", "value": "858511515f08f8c87b8366d3d73b725c45df4fd343723d5d64400e37919cd560fea80982273c58d630ca1287ec03823f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699533543, "uuid": "e9d3c304-51cc-4786-88b8-f3d72d1397d2", "value": "T17934FF03BE44EB11D6583D3B92DF6D2853F1A4C70673960BAF88AE6A25412436D7F32D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699533543, "uuid": "bea696f7-c69f-4bbc-a1dc-d32ac93df581", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699533543, "uuid": "130c06d9-41b2-4e7d-b9aa-6f83f16565cc", "value": "3072:s+4BDiMdH1L/mbO5uBCCP1UpzuV+IXyTdrhDfMvy:WBH1LaO5uBCCtEzk+6od+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699533543, "uuid": "7cc93270-c6fc-4d7f-ac04-564aa41eea27", "value": 242688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699533543, "uuid": "d3135878-0807-4df4-8c3c-18da5020a2a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699533543, "uuid": "7247e6b3-2d91-49a3-a9a7-a4eab7143f78", "value": "436c26131eda78a0614870150389dd719a2ca8b1793d57c36ffc5f3d9c757364", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dace2e7-7f1b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699546708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699546708, "uuid": "b285496a-7a24-4dc7-b912-5bff5d3ea961", "comment": "Malware payload", "value": "257949fa03fb85ba5e2a53c05a5ad4ff", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "CVE-2023-38831", "colour": "#FF3A96", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699546708, "uuid": "9a0244d1-9852-45bb-9398-ee5d31b3e8f6", "comment": "Malware payload", "value": "437928a8ea347a56fc84b0f0617dc8000c8b356ed3262e44897369134bac9197", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "CVE-2023-38831", "colour": "#FF3A96", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699546708, "uuid": "eeeb3751-066b-42ba-bd97-e52ddf8057be", "comment": "Malware payload", "value": "bf48fa4d9b12861b4a6fd411bf0cf38691da6641", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "CVE-2023-38831", "colour": "#FF3A96", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699546708, "uuid": "2eb4e246-ba2d-4fe4-a461-4cd794bceac9", "comment": "Malware payload", "value": "e22a6e5c72a4afe2a15c25921e543c7603372023804b1aeb9aed58a6b0097a29375e92e219f6d5c5643c3de0a1495576", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "CVE-2023-38831", "colour": "#FF3A96", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699546708, "uuid": "584990bc-451e-44dc-bc3a-170ab14d511b", "value": "T19D6302113EA35597B759714A18A7EA2B5CB87C8ACF168560C83AD4E464F2CC307CC77A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699546708, "uuid": "8224b51a-4e09-496a-8c93-271d3e2e9a5d", "value": "1536:WvHxtfvFghkoNrkOy4WQ4L46OeEakPxUEFRieGgWrkTUMitIa63xI/8n8:WJVGK2fy4T846O3TFRBGgWrkT8tIa605", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699546708, "uuid": "e058866a-09c3-40dd-9152-f6e344257af6", "value": 68630, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699546708, "uuid": "4d8b8a1e-3338-4045-9305-133606040cc7", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699546708, "uuid": "08d99760-9029-4664-b5a0-1436041aee01", "value": "nine.rev", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b078599-7ef2-11ee-8907-42010a9c0042", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1699529067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699529067, "uuid": "cd1df579-a9b7-4b9c-b82f-755331a30ee2", "comment": "Malware payload (AveMariaRAT)", "value": "25381b24d6e3a89a4c2e2ba88a9bdf1c", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699529067, "uuid": "22f2b38a-5b8d-4e89-a46c-61a8e6b124b3", "comment": "Malware payload (AveMariaRAT)", "value": "45249449ecdd0f8cab15e995eed6150adcf4e366b4e9ff834ff048c7b8e9b4cf", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699529067, "uuid": "9b02c32d-4502-4ff8-a1d3-ec372bd55979", "comment": "Malware payload (AveMariaRAT)", "value": "b533f8a1356635c896636419a377839ee4f31833", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699529067, "uuid": "bdc6f5c3-ada6-4987-a0a4-06d5c567c68e", "comment": "Malware payload (AveMariaRAT)", "value": "f451829872e1633093c0efce7b1e2783eebd98044b4ed2c00cbfb9f299347af991bf563370367026e9ce529439713921", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699529067, "uuid": "c9108c8a-a5e9-4485-80da-f3eb693b91e5", "value": "T11B34F01D9A9ADF9BC9800435F06085F60768CD48C996F34B289E7D3EF876B98E4B3750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699529067, "uuid": "16ee6434-53f7-4387-80e9-61f5a7d529d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699529067, "uuid": "e2c05444-95a4-454f-acac-dba04dde7fc2", "value": "6144:SoADJToq5EMG4mhm4ilzywDFUiwBP/DGDMDSj:ADhNczTPrGS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699529067, "uuid": "a87c0be5-d574-4e5d-9974-1f4199c92efe", "value": 237056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699529067, "uuid": "d1010c99-d5fc-489b-bdf9-894a57843096", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699529067, "uuid": "f9b54ff5-4a15-4d9f-8e52-277a3542dda5", "value": "45249449ecdd0f8cab15e995eed6150adcf4e366b4e9ff834ff048c7b8e9b4cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e4a870f-7f13-11ee-8907-42010a9c0042", "comment": "Malware payload (Pikabot)", "timestamp": 1699543085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699543085, "uuid": "f4aa7292-9334-419c-9e8a-0d6ac7278f9d", "comment": "Malware payload (Pikabot)", "value": "2b2502d2bda41c8bb9d54ab407f6fa67", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699543085, "uuid": "82cfb19d-87ee-418a-84c8-ff38c336c58e", "comment": "Malware payload (Pikabot)", "value": "474cf793bf8eb32be29f8573c6c235a2eb93705de2364a4f5efa6d400ac5fc77", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699543085, "uuid": "50032f92-32ca-42d5-ad21-fb42a9dc0db6", "comment": "Malware payload (Pikabot)", "value": "921d4a5c0010debc664916f352c17644603c8611", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699543085, "uuid": "55212d58-9eba-4bd9-9f13-be7458551e88", "comment": "Malware payload (Pikabot)", "value": "42bad9a93587e063b8bc5ee1816d569e303abd1253999a2d7a4714e6769cb56f5713acc8ac219d52dd61905fba6ee024", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699543085, "uuid": "10ad7b67-df7f-41dd-b09d-e56117a84f25", "value": "T15425F8F3F4A4A2B5DFA19B55D42ABB19F00730838AD5C4CEE914C51C7E886DE027739A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699543085, "uuid": "2148f97b-81b2-469a-9cc7-5c8c89a0d5be", "value": "24576:AtvrSTxpsMdoOI2ojDrK7AZKvOFY8xix7YX3kHrzY0gz0eXiA51AOwa1NBq+TbG8:A1r3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699543085, "uuid": "300f13e3-89de-467b-b6f3-0f5aee1c2200", "value": 986831, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699543085, "uuid": "401b38b6-8931-4bbc-9a11-ce10edc73370", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699543085, "uuid": "93d60e40-dd8b-40db-aee7-e3d428d381aa", "value": "SXDK.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b59a53bb-7f24-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699550613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699550613, "uuid": "2341a290-ec7e-41bc-82dd-0a3db0fbad3c", "comment": "Malware payload (AgentTesla)", "value": "ad1be1ce20437f493d0cbc529304750d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699550613, "uuid": "27c5b2ee-664d-46d7-9380-35de05b6c15a", "comment": "Malware payload (AgentTesla)", "value": "47c0540197e3f9afd735a3a814517e2ed9b7b32a4118c6b2bf1ac780ca9b5eb8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699550613, "uuid": "4ea130a1-21eb-4553-a102-5bd508ccc1cb", "comment": "Malware payload (AgentTesla)", "value": "c89a238d2eeca68dd12913dcad70a840056eb4c9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699550613, "uuid": "72667abd-db2a-4ce5-9158-a8d1f9c40673", "comment": "Malware payload (AgentTesla)", "value": "554d07aaac56d1856ce02da9822c2b856bf6c8dd3c3509246fc825644b454f7b7ae109e8fb4d2d6f6a2380fcc1bbc334", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699550613, "uuid": "c1705774-f19e-493e-84f2-8cacc1fa9ce0", "value": "T1BEC423B614F7D797108B1CB68782AA96D2F706908CABECD70F27B11CEA77C462C9D114", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699550613, "uuid": "b914e1b6-b27c-42fe-90b0-2740cef1d768", "value": "12288:woUhKpx0FXlQK2cYIiveEjTbkz1BKIUl5UgRMJ:wooKZnveEa7KICQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699550613, "uuid": "c8b381a5-25c5-4246-b441-fdfe6d2435b5", "value": 582042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699550613, "uuid": "0b513741-e5b8-4930-a873-e9389f299538", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699550613, "uuid": "17adb7f9-e41b-4f5c-b986-bd948edc34a0", "value": "order pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbd997fe-7edd-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699520156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699520156, "uuid": "218c8bed-5284-4578-a46c-7be0a5bb3ea6", "comment": "Malware payload", "value": "5f1e702f41cde638a5224649bc79014a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GlobalNet", "colour": "#E9D9B9", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699520156, "uuid": "1ee97da2-5590-4997-a178-5204079cf902", "comment": "Malware payload", "value": "47e22cbf6589c3dd365f2fad8aa2cdf64918ce2cc82bfd873d727b899efe648f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GlobalNet", "colour": "#E9D9B9", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699520156, "uuid": "1277eafc-9ea5-4796-8711-df1c7fb00db5", "comment": "Malware payload", "value": "179e6000e49f7bf8a64ac28959456449950ef14d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GlobalNet", "colour": "#E9D9B9", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699520156, "uuid": "b8a37a48-4e2e-48a8-8aa7-c0c3dd59ebaf", "comment": "Malware payload", "value": "6764990d9d9b85c94fc0b63e03949664efd69c6784cc10725f272c9d1e7970e7ab37310cc7c7a842fa28a026c82295a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GlobalNet", "colour": "#E9D9B9", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699520156, "uuid": "44606dac-9324-4479-91f2-5ce5406572a5", "value": "T121E73340D1D02586E4693276948CB2756DD36C9BCF67B2770FE4F0420EBB9A9DA34EB0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699520156, "uuid": "4d1823df-b0dc-4cad-8a50-f966a67540bb", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699520156, "uuid": "5c2220e6-35a2-4fa7-a810-4ac7320779c6", "value": "1572864:2xXGMK4XR3bLSCU/+6yoYC+Nob3OHzDCd5M7wkFD2KlmCWJAr:2xgYRPSC++6yo0Q+nCdLkFD2ymCSq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699520156, "uuid": "dcd32846-92fb-4109-adac-3dc8dc052230", "value": 64061029, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699520156, "uuid": "54aafe2c-f799-46d2-8308-af2abeed3136", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699520156, "uuid": "5259363a-8d02-4b9a-bb4a-c68eb30caeb2", "value": "MultiCheat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "210f747c-7f53-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699570550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699570550, "uuid": "2a5bc477-1c55-4795-b166-1ae3d5029330", "comment": "Malware payload", "value": "cb7068873d181e7bfb2d39b4c2e885a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699570550, "uuid": "58144ee8-3ea6-4ceb-834d-74374f8b23be", "comment": "Malware payload", "value": "48898dff7dfd62c677aa3ec6c395f40d2f9ad60c3f53cc58a4cee5dc70727d5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699570550, "uuid": "5f1546a0-65e4-4b15-a144-49e6cc34821f", "comment": "Malware payload", "value": "2c8cfba4416fe973edbcd3680197924647680c7a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699570550, "uuid": "d0ecec69-40c5-41b2-ba93-f91518777915", "comment": "Malware payload", "value": "4cd0812b79d1f1103fe7179f900828e3c01354b1560d3353c61bd0369a342acb066d47bd8a396034474124785b00315b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699570550, "uuid": "b42c48e6-926a-4192-bba5-52c5df007112", "value": "T158B40252E5D84072ED7517B029F702D30A3A7CD1E978832B238AB86B0DB3AD49935777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699570550, "uuid": "cb49db05-d0cc-4fcc-9550-778fa4b2cd84", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699570550, "uuid": "854614df-1ad9-4ea0-a2fe-1b39f0dc2177", "value": "12288:XMrVy90mbRJH+wD42Y8TUs2ouP+4+wSRVFJf7OW:iyRxYSz2ou2US/fzOW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699570550, "uuid": "ee6ac516-b29b-420e-a887-af7e67295e51", "value": 523776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699570550, "uuid": "40a3dc97-d8aa-48a4-9279-79c087a92c46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699570550, "uuid": "90beda96-60ff-44a0-8c50-769f002b3fa5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b3a26e8-7ea8-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1699497177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699497177, "uuid": "fe44a22d-598b-4361-a096-1454114ac4cb", "comment": "Malware payload (Amadey)", "value": "bdecfa9b283c2eb83a2ee182bd1bcd9b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699497177, "uuid": "608a01b2-fdb8-43c7-b3b2-0f33ca8b2288", "comment": "Malware payload (Amadey)", "value": "49eb7ae3dc1471e864bd0daa995ec894961dcf307354d37b675a01adbcba6490", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699497177, "uuid": "6724278a-3327-4ce0-994f-8b81f911a087", "comment": "Malware payload (Amadey)", "value": "69e5768b2805d414761eb894ae4b1775cc84105a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699497177, "uuid": "7f9c1ba7-72bb-4a2d-b3fa-fd9bd690055a", "comment": "Malware payload (Amadey)", "value": "0065e1cd264ffcd4fb70e7a3acd3b210e0bff1ed01b5cde12083758d835ca0adf26cc51488d9bc1f1d7ad85bac55fd8f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699497177, "uuid": "6811dbf6-fbe6-4d41-9c57-34aa1e1a74ea", "value": "T1A4647D60E2F6550EE1E75B359E7063E5A13675123B22E26ECC84E44DB43CAE38EC1663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699497177, "uuid": "a3bf34be-8661-44c4-af03-93de34d32fdd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699497177, "uuid": "159e3906-4f11-4d28-9e64-b949cd65bd0a", "value": "6144:cZEyWrtoom1kRDq0GD+PfZgM6DN8O4tgIpOs4LsBRxNa:ZHtopKq0E8dvpOs4LuxNa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699497177, "uuid": "e3eb1342-df10-4d86-8c3b-29db1347188c", "value": 319488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699497177, "uuid": "9064335b-e28e-49c6-87d3-d9b090dbcc12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699497177, "uuid": "5fce4c43-6ff5-4db0-978a-ce33e5220f91", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eda1bfc0-7f27-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699551996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699551996, "uuid": "45d8902e-cfa2-4677-beae-b667739f252a", "comment": "Malware payload (AgentTesla)", "value": "2dad1eff5a36b22cff96b7b76ba631f6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699551996, "uuid": "9e490db6-09a4-4445-92e5-a4d70412d57a", "comment": "Malware payload (AgentTesla)", "value": "4a07d88e1329d3ed249e4a207c6cd75ea11828edd37d2ca3ed4f58cd73d4d45b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699551996, "uuid": "84705f87-e74b-497d-8f8d-186ef5937ccd", "comment": "Malware payload (AgentTesla)", "value": "be064f9c9c06b25cc027b7636aeadedc91305c8e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699551996, "uuid": "a83b5c52-69a0-4295-8458-55c60c802bca", "comment": "Malware payload (AgentTesla)", "value": "c7385adaa9d944f1f2cddbc14892c3eacdc56aec03f53874021b80bf0bedb8bcd03d66e4a0f53d9cf258c5bd6ecaacc3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699551996, "uuid": "64c66581-6f39-47b8-bd6f-c19c18f2b905", "value": "T1CFF1D811DBA85333EA2F47BEDDF34342577CE64448C6EF6F288C62546D02A501C6A7AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699551996, "uuid": "95627177-68d9-46fb-b2fa-d1e10ded2eed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699551996, "uuid": "99d21a58-1d86-4e75-b802-62a4570b954a", "value": "192:2XaKhwWNwm3OcPEu/4X/qO9Uj7OsgLrv:wNZNwMzEuwX9pn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699551996, "uuid": "2424f523-ee6a-491d-be8c-228af1cfcada", "value": 8192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699551996, "uuid": "5250cc4b-d59d-4711-9178-7b309e33e038", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699551996, "uuid": "d807f805-6acc-4b5a-bc27-d7609a35d8f8", "value": "DOC-COAU7885047820.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57ff7a06-7e9b-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1699491615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699491615, "uuid": "24c70f95-e069-492a-9052-d968753c0995", "comment": "Malware payload (Stealc)", "value": "98f1d60325fb6223d2f6b65f227661e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699491615, "uuid": "350933f6-e8d4-4158-b3a7-77804a04a531", "comment": "Malware payload (Stealc)", "value": "4ad2ea4b4437171ad9395ab707ac7c66321e11d924b0324899102d91d1528cd6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699491615, "uuid": "0fd1d0e5-1c81-4117-85c5-d0f3dcb1cc50", "comment": "Malware payload (Stealc)", "value": "2801366aa21221e46a1014873d4c2d1498a5b8c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699491615, "uuid": "4d7b8834-709f-4f12-aa0e-c87fd067c582", "comment": "Malware payload (Stealc)", "value": "bcdcb88694e82fc2769d9f16837bead42ef727bb295db2b1e9ff65e74c7157f1c1a5a8b65ddb3cc0020eaee2b444ec47", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699491615, "uuid": "53efbb1d-4326-4c64-b96e-ac2d828b3f5a", "value": "T1C164FA4352E33C55EA26CB368E2EE6F8771DF9518F0BB7A61118AB1F04B11B3C1A2715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699491615, "uuid": "888d2853-0d04-4748-aedc-53161a7e133e", "value": "b7e07a5800cbc9c6f303fe6cbe1b23f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699491615, "uuid": "9801d15d-c1c1-4a4d-9d8c-66a1b505b7d0", "value": "3072:/VrGzJMaa67k6n+/kpmGy4+H//okvST4Jfcuhqoqr7QMXVsAPkgjB9gAHsEz:4zGaank+/kQymHokvfcM0I4/jfRH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699491615, "uuid": "8fd02011-f023-4819-afe4-782bb254e75f", "value": 325632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699491615, "uuid": "13874ec0-f4ac-4c2a-b4cb-111219b97f7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699491615, "uuid": "cfed00b9-02c7-4482-842b-cc2bc92f1c91", "value": "98f1d60325fb6223d2f6b65f227661e8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03edad5b-7f0d-11ee-8907-42010a9c0042", "comment": "Malware payload (Pikabot)", "timestamp": 1699540437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699540437, "uuid": "639703d0-6621-44f5-9466-5b6cb4cda150", "comment": "Malware payload (Pikabot)", "value": "559385077e755918956c0549631278ea", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699540437, "uuid": "44d61a9f-d4cb-4bb8-ac2c-36a8213f49d2", "comment": "Malware payload (Pikabot)", "value": "4b6381f8ae9e9347dc019d12c4b05d113bac8609d8ba4f8511329baeb74615ec", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699540437, "uuid": "098431cd-65b8-4b47-a62b-35eece682149", "comment": "Malware payload (Pikabot)", "value": "afcf26bfa1774715e65d0c19a3bf7ec0423ac5b7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699540437, "uuid": "1ffa0fee-29cb-41ba-8271-1475a5dc5f72", "comment": "Malware payload (Pikabot)", "value": "4514c5174f42c3ee7e6f53c02e553108953b2810cd4ecab144bc4d01452b30c6d8aaa7221468e92a6d9b325250810c69", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699540437, "uuid": "dec44166-bb32-4641-81b0-86322ea2f915", "value": "T133C5D003BB8259B1E5CE067961B66B7F4E3A9610D324C9D3CBA12DA5CC312D1673E38D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699540437, "uuid": "1e352735-add7-4501-b456-90c424b2902e", "value": "f25ba11cc2f9d886b0989a9c392d11cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699540437, "uuid": "ee8c11c2-3357-4035-be4a-ada6dd850b5f", "value": "49152:921mU+j4kNwzaKPvghxk1CPwDv3uFmAVpzCTJueu+FNRdonOMyDWmEjGmH9g:9218wzakgDk1CPwDv3uFmAVpzybFNRKA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699540437, "uuid": "2f6a6764-180c-4515-be7b-acefad038586", "value": 2615808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699540437, "uuid": "bb60800d-8fc1-48d2-94da-e576dba34636", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699540437, "uuid": "46b1207b-3933-41dc-9865-8a536c07bb77", "value": "HeelersFiorite.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a361534d-7ee5-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699523524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699523524, "uuid": "04fa7257-711b-45cf-91f0-dc9993d86669", "comment": "Malware payload", "value": "2dc2dd24f4a23cb6f3872b4c068b24e3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699523524, "uuid": "74ff815f-fb1f-4c48-9590-722125c6dd57", "comment": "Malware payload", "value": "4d86b28765c20fcb8054ee365f250d43a34ba2f1714294ce1cfa9fe86c91b6f2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699523524, "uuid": "be5955e4-f34c-4880-9f67-38c7802b9189", "comment": "Malware payload", "value": "c6e901ce7c0c6f921000fc7b5c5c1939fe8a69c5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699523524, "uuid": "4ed47b3d-1fd1-45fe-8557-c3344868adc5", "comment": "Malware payload", "value": "33d7cf87443047485a2bb05fca23a6ca9ce612e2e3b80b6f1b4201141aa54204b8551a1a515460e0f74173e5158a7f58", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699523524, "uuid": "65ebd23c-ae7a-402e-aa7a-aba193846073", "value": "T137046B0179818071E1AB02394578EB12177E7D71CFA59ACBBBDC4EAD5AB41C0AF353A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699523524, "uuid": "f435211c-2488-4b58-9698-1c1cd2daf185", "value": "2aadcf41e769ae9a7dccef1f44c7fd25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699523524, "uuid": "6d6494ca-ab49-4fdb-9d5e-271e8507562e", "value": "3072:qwUVxvgL8d4YbthExXpVlAxEY8J0+DUr11xr2xL5q0:qwUVxYABpqxXvlAxf9VbwX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699523524, "uuid": "9ddd96b6-1102-44d1-962e-2ef06242655d", "value": 189440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699523524, "uuid": "97b7c15c-d537-4999-99b7-0e1d0866bd12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699523524, "uuid": "4dc3c0d8-67f0-40ea-bf80-bc53d68f809c", "value": "final.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26b92f9a-7ed0-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1699514296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699514296, "uuid": "dab7dedf-0312-42e4-aa93-c09f4c6f04e4", "comment": "Malware payload (RemcosRAT)", "value": "6e29fff42de3c3d567ed9a1bc5b929b5", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699514296, "uuid": "d57d230b-ef25-43bc-b900-dcd184adcefc", "comment": "Malware payload (RemcosRAT)", "value": "4dc004e3df7a834d16e8510e90b61e5b211dbef9e563c9d5471ae9ec9f7b9a2c", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699514296, "uuid": "455c5780-5a54-409f-945f-3b7e12efde5b", "comment": "Malware payload (RemcosRAT)", "value": "9aedefd5035a3f0def49d63c41392930eee0f231", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699514296, "uuid": "75fd0b39-dcb2-47d4-ad51-9114d83c45aa", "comment": "Malware payload (RemcosRAT)", "value": "8baddadeb3d06a87b98f8dead15b28fc916c38b4b3a85fd0c082a3440ced59b45a8afbd4617efba4e0a400cb2ad69251", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699514296, "uuid": "e2760e0d-567d-4cce-8f98-89c383be8bec", "value": "T12D23E462D6D4F71C48CA278EDC43894081A58525E21277B9BDB8528E71CEDCCD3AF6CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699514296, "uuid": "2e995e3b-06c5-455b-82d9-97db1f0c1c2b", "value": "768:xxmAettWD0SB+70QInPp0ReHelOUZLq43sWACSH24kGj:xxvqoD0yPuReHe1tqKsWNSW4kGj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699514296, "uuid": "5504a751-97d2-4f5f-bc8a-05724e96612c", "value": 48435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699514296, "uuid": "4442a7ea-a286-40a7-8d36-711830a0d898", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699514296, "uuid": "ea1e81bb-5d00-458d-a7eb-75dab309c119", "value": "Confidential agreement_11_8.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81035297-7edd-11ee-8907-42010a9c0042", "comment": "Malware payload (Kutaki)", "timestamp": 1699520031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699520031, "uuid": "ae4b417e-13aa-412b-afae-4bdc3b332002", "comment": "Malware payload (Kutaki)", "value": "800999621ec6036d4ca4070733a1a76a", "object_relation": "md5", "Tag": [ { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699520031, "uuid": "42d131d9-b3b2-4a28-82f3-2f9c7413b9f5", "comment": "Malware payload (Kutaki)", "value": "4e95c654625af3c239740b6d8f1799d5ad938bcb9404d2935c5240c22985d76b", "object_relation": "sha256", "Tag": [ { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699520031, "uuid": "1f57e5d2-75fd-4946-b8c9-37150aa520b7", "comment": "Malware payload (Kutaki)", "value": "53ee4f63acd929f3a74f91367535015643f2fab9", "object_relation": "sha1", "Tag": [ { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699520031, "uuid": "6c5ac7dc-85fa-4e3f-8125-9bb72d8b8f8c", "comment": "Malware payload (Kutaki)", "value": "c2f988eaabb577a039e970f8c21ecd35478a82f6ac244b3fa0053f4ed7f65cb7de890dfa6c221e7039b70470ed7e3021", "object_relation": "sha3-384", "Tag": [ { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699520031, "uuid": "de3c1aa0-ddb1-4a12-a517-5774aee952ab", "value": "T1847423B81A8A0FCE55CD64B49B23F5B207800AFF170165D54E9A73EBC589643FA4B21F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699520031, "uuid": "62ec6280-98e4-4746-8d46-4fdd2b1f3349", "value": "6144:AtqN2xpd9yDiR2Z1+4GpA9jQHL/VCSS3hwVlMbk2u5QMSIy+lqkHTonerW/lYRN:Atjpd9h2y48A9jQr/Uh8peMSI8EknPd8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699520031, "uuid": "c6be0af8-b880-4727-9199-e63427fd07e1", "value": 344530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699520031, "uuid": "1ac008fe-f388-4cda-ae3b-2669d578535b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699520031, "uuid": "84ff54c1-1486-4d2a-9022-0a76f5d1256c", "value": "800999621ec6036d4ca4070733a1a76a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd1db5c4-7ed0-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699514655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699514655, "uuid": "8291b17f-9d9f-4c1d-8983-73106f7cb67e", "comment": "Malware payload (AgentTesla)", "value": "00c758d48a0554f4c99b4cf88a435c05", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699514655, "uuid": "d7a7d36e-a81d-4d83-acf3-f6f733cf4cde", "comment": "Malware payload (AgentTesla)", "value": "4f1a449c4179eb2b282228281d26bc92fd17821b24a1a66b50e37021d5704a74", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699514655, "uuid": "5e61c19f-6704-40b9-9bfc-2d9897edf28c", "comment": "Malware payload (AgentTesla)", "value": "66720e8cbb6569c013b4156a44fe92970c1cf588", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699514655, "uuid": "2fc48993-b02b-405b-a739-c4b89ae07436", "comment": "Malware payload (AgentTesla)", "value": "76789b82e292adf13a425278cf5c602b6c365e30855da732580779d2ddcf0c817d074ce8c8e8365464948832c5c1f12b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699514655, "uuid": "5a8898de-c695-4967-893b-1963626009fb", "value": "T185E47B3D5DAD1637C1B9DFA58FC1842BF1D4A9AB7151AD78A4D303AA4302E16F9C023E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699514655, "uuid": "b8010626-9ed0-481e-a338-e1a63c493657", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699514655, "uuid": "52b20fb4-8691-4b1a-b623-f756f15e29dc", "value": "12288:PujtXTyErmj0LUl6XqWLqKUxchYOVKGVh1demIeVN:QOErmj0LUlDqtYOVKu70m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699514655, "uuid": "67cfccce-5e51-43dd-93a1-985e425f2a5f", "value": 702464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699514655, "uuid": "9a3ab460-a210-4a39-8e1a-4d11bac5f93d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699514655, "uuid": "9e5aae5f-1562-4af1-8522-659689add359", "value": "00c758d48a0554f4c99b4cf88a435c05", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "463e9323-7f55-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1699571472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699571472, "uuid": "b432ba9f-7379-41ae-9405-dd2cd87d24b4", "comment": "Malware payload (Mirai)", "value": "cf3c31ca1cbc65b87dc9515fcf93272b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699571472, "uuid": "00a85209-a785-40d5-bcf0-58475a53c7d6", "comment": "Malware payload (Mirai)", "value": "4f5af4a98cc50e3c536a552112579cbba97cfa7c64fc9626b32fd418c5abad8a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699571472, "uuid": "5d8e1fbf-592a-447c-af6f-d976a3fa88a0", "comment": "Malware payload (Mirai)", "value": "81d49313c9b76ca777723a1e974ffe2fc3acc88b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699571472, "uuid": "ef0c144b-0f39-42c1-84af-b3d0bef0902a", "comment": "Malware payload (Mirai)", "value": "76e3d51e4f6de76e358635430018a3ce3178d424b1da655671d58136079b01e32b942a56dd304bd2fa457b40ebeb1c9a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699571472, "uuid": "2168b124-e7a7-4139-8c27-d24741ac272a", "value": "T1E2632995F4029F3CF88BD6BA50170E05B92163D057C30F2BA6A6FDA37DB2068BE25D41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699571472, "uuid": "2512ecb8-d8ef-478c-8540-fa4b523f7367", "value": "1536:q2gDyZk+B1esvFIl8Ok/zoJWnXKtnXwvU:q2gDb+HLv+g/BXcXj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699571472, "uuid": "b2bdd214-1dea-4c44-a5ab-c7d2fe7bad5d", "value": 72328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699571472, "uuid": "008ace83-9875-44fd-a47d-622649788a40", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699571472, "uuid": "e8a5f6b1-b368-46eb-bd39-11523cc3b7ae", "value": "cf3c31ca1cbc65b87dc9515fcf93272b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acf413b0-7ef5-11ee-8907-42010a9c0042", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1699530412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699530412, "uuid": "997179b6-6f50-4d2b-a8e0-af4c9e2dde75", "comment": "Malware payload (AveMariaRAT)", "value": "244db4e8ce1a6f52dc563f5d10b6e409", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699530412, "uuid": "a5863347-11e8-412c-9ad6-0c7a24933b27", "comment": "Malware payload (AveMariaRAT)", "value": "4f7af68587dac646acf2e482c2a2e9e4025ef46dff19b9a1fafb202abddfaa5c", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699530412, "uuid": "9c62599a-87a7-4ff4-b9a4-ad19872622ab", "comment": "Malware payload (AveMariaRAT)", "value": "31e09309a0b309c59a1046cb770bc12af74cf6b3", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699530412, "uuid": "8e7fe4d7-bfc8-468c-9fbd-7f2c837cdf88", "comment": "Malware payload (AveMariaRAT)", "value": "2e67d156107f3d8d216953aa83c102ac38ef63c314b004508e45786893224ce47fc2e46723841dd7a233d5d146ef196f", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699530412, "uuid": "7bb40e5d-2659-4a71-b147-77b8a2c1e685", "value": "T1E434F21AA3C9CE7FE9250831D43184F12731ED99CA96DB23555FBD2CF936AEC90E2580", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699530412, "uuid": "b701a792-736e-42d0-944b-76b42fa62054", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699530412, "uuid": "1fcd03f1-afeb-4b49-8d9b-f14cbe377b91", "value": "6144:FYgGgcnSYhEM4aP95Uu2BCh6KV2iBBBdVF8iwBP/DGDMDSj:d6j2M9yRshpV2iBBByTPrGS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699530412, "uuid": "04cf29e2-6405-4084-aaf9-907f4135fc52", "value": 237056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699530412, "uuid": "7e3def57-f4dc-4533-8367-06c57a5c3f6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699530412, "uuid": "ef17cdf7-ab7b-42c7-bce6-4d1b92fb11ad", "value": "4f7af68587dac646acf2e482c2a2e9e4025ef46dff19b9a1fafb202abddfaa5c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82211f59-7ee4-11ee-8907-42010a9c0042", "comment": "Malware payload (MysticStealer)", "timestamp": 1699523039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699523039, "uuid": "587a0b24-9250-4ff9-ba59-8dd805abc6ab", "comment": "Malware payload (MysticStealer)", "value": "21192f9226b426a68714d542ec4f6276", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699523039, "uuid": "ecebe0c2-993a-459d-8d60-4b5d4af6a2e2", "comment": "Malware payload (MysticStealer)", "value": "5010e4b61346afb68f1e445479152e970e5cbea71617cccb6746f6ae6acd0d63", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699523039, "uuid": "a968266a-f4ab-4c5c-b68c-dd6f5506ecfc", "comment": "Malware payload (MysticStealer)", "value": "0738469fb1e1d4fbac2f282af2cd4a8fcb54bb09", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699523039, "uuid": "04759eb9-eb20-4a3f-876e-d888f3c4e06a", "comment": "Malware payload (MysticStealer)", "value": "76821a8e42e222c9464b546e66188bb005dadbb955a454040b0c1ae4f87090219df116b16e02a99e6308db0c5c2386f0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699523039, "uuid": "d33efa70-0c13-4c98-8405-0a2780b34925", "value": "T16D64F142B6E84133D8B12BB018F602D30B327DF19D78976F2755A86A1CB26D4E43673B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699523039, "uuid": "c99e8cf2-9d67-4ea6-a0cf-f2b17296f05a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699523039, "uuid": "7124bd84-2b0c-4aa8-8217-f9d839ca9b3e", "value": "6144:KPy+bnr+vp0yN90QEhfxZkJzEb+hvv4ANtOJejtBCieBevfasBEpU:1Mrjy90nffMEaZvrNuelnHipU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699523039, "uuid": "5f3b48ba-4c15-4d31-83ed-641297a0a574", "value": 331264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699523039, "uuid": "4e3f7ebb-e1cb-4776-b068-bbccf61301da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699523039, "uuid": "0631c112-7fe2-4861-b17f-14f9f226dcc0", "value": "21192f9226b426a68714d542ec4f6276", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccc30900-7f3a-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1699560101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699560101, "uuid": "6f6d9547-b83f-4042-be99-a85c3a69500b", "comment": "Malware payload (Formbook)", "value": "3c57347ada75cddec062a5fc33d52773", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699560101, "uuid": "d2f86dc7-9e28-4289-922c-ccba2025fe24", "comment": "Malware payload (Formbook)", "value": "50fc82d5c17dd18d51f9c65c690592c4af3717d213fec18bc06543729bc464bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699560101, "uuid": "01115318-8214-4baf-9646-cdd413e1a7ee", "comment": "Malware payload (Formbook)", "value": "066ed96e476424e4d1e6a2c203a1e11f1a536592", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699560101, "uuid": "714dc34c-27d7-4798-b117-541eaa89e227", "comment": "Malware payload (Formbook)", "value": "014574fc4cfe1b8223bb0a1eafdfb002260e2a9f1b35b98459fde2ae319bb27f78cab8310f494e4dc9d077319530a835", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699560101, "uuid": "38384b85-eecb-4a96-ac7e-5ee6524ba954", "value": "T1D0F47A3D59AC163BC1B9DFB68FC5D02BF1D4A9AB7151AD74A8D303664342A16F8C023E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699560101, "uuid": "d1865417-8b4c-4cc1-b590-f071e59b1aa9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699560101, "uuid": "3d078318-d711-4ed5-b364-4ccb7a4594e4", "value": "12288:s8Y2jM6AxQogpTGqhkNxDOXMcyYSEPnzaDj/YuaiYx:3Y2oPDgTy7DOXnydEPziLaiYx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699560101, "uuid": "02ae2646-b568-4629-a11b-d468732dd0a8", "value": 735744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699560101, "uuid": "abd410fa-bfa3-47d8-84f9-195fc4f58faa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699560101, "uuid": "83a396aa-4dc3-4bb1-808a-620badd181fd", "value": "INVOICE#20231025.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db7d745e-7eea-11ee-8907-42010a9c0042", "comment": "Malware payload (MysticStealer)", "timestamp": 1699525766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699525766, "uuid": "8e9bf826-2993-49c3-a983-5a4271ea1b5b", "comment": "Malware payload (MysticStealer)", "value": "233bb0364b94224cb3ca55ad85d4ad4f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699525766, "uuid": "91fbb260-6750-43da-994c-055461f1be0c", "comment": "Malware payload (MysticStealer)", "value": "51cf4ded5814411780a10e969be0e0f2a0ed4674070a7c5cbc4d674f7658dc87", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699525766, "uuid": "8f26984c-5e3f-41ec-ab4c-9f18ed23b8a7", "comment": "Malware payload (MysticStealer)", "value": "511a45ba669dfb22c1de2c98f7781f8c50e85096", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699525766, "uuid": "86c305a3-9b6c-467a-84a7-78ea44deaea3", "comment": "Malware payload (MysticStealer)", "value": "dbaf32323a5489704e3a5befe76399fe7a1fd6a703f8708cda838d726d3a96c7100965c606e241cfdae76422559e3916", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699525766, "uuid": "a6432d8c-4baf-4dd2-93b1-c28fbd6f2ef0", "value": "T19764F14396E88072D8B527B058F603D31F357D91AE7883AB3745AD5E1CB3694A93233B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699525766, "uuid": "497b11f7-2280-4bcf-a4ad-1b7607ad91b4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699525766, "uuid": "3e520046-b8fe-4e10-b660-a6a4fcfdb8de", "value": "6144:KXy+bnr+op0yN90QEkpgZRxBvB73LXlr87DD8sl28NqR4:JMrIy90mgZRxjrifjl/NqW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699525766, "uuid": "4d9659d5-fe33-44aa-8219-86adffcab4e4", "value": 331264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699525766, "uuid": "6b5931b2-d637-44b4-8477-068ff271b019", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699525766, "uuid": "c48de886-76ef-4af7-8b75-58918d0fdb26", "value": "233bb0364b94224cb3ca55ad85d4ad4f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71220c33-7ea6-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699496382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699496382, "uuid": "d0ce8703-23b8-4838-a73c-953fd82bc103", "comment": "Malware payload (AgentTesla)", "value": "a2307c0517604c229fea7c3ccca9aecb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699496382, "uuid": "c49a6e06-943d-4383-aede-15664f923020", "comment": "Malware payload (AgentTesla)", "value": "525ef1601fb26d98410a4de2acbc10301096de67a6323c96df9ae4349e8eedb0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699496382, "uuid": "d3664478-7b35-4d35-a3cc-8a1ed8436c95", "comment": "Malware payload (AgentTesla)", "value": "97f094a7819705001920c855b9a9156dd1d7476f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699496382, "uuid": "f3e55d95-7b9d-4438-acb1-88def0c2becc", "comment": "Malware payload (AgentTesla)", "value": "a46d9c97f69e05cb687d8c2adf354bf3e25cd61908000c92034358be5d3ca1c131b2412978dd75874d500523ffbb8415", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699496382, "uuid": "59cd543b-8593-44fc-9254-26263c3ae752", "value": "T1B0E47B3D5DAC223BC1B9DFA58FC5C46BF0C0A9AB7151AD79A4D303A64342A56F5C023E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699496382, "uuid": "412a5336-834f-464d-8399-ea09b3dcdc46", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699496382, "uuid": "041cf7e3-61d8-40b9-8f92-b10550ddd935", "value": "12288:ML0WNisb2eZ3jsU0qbQrjZagMz24Axn/d4aE9dVV:ZWv2W3jsUhbQfZagMzK/u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699496382, "uuid": "57307f47-d4e7-4002-a368-1d5043e02827", "value": 701440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699496382, "uuid": "e65a5738-bc29-4024-9fe6-74cb12c188c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699496382, "uuid": "0b1e682f-e79e-44c3-862c-b7aaaf4f463a", "value": "SecuriteInfo.com.Win32.PWSX-gen.7241.6231", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11aa503d-7f10-11ee-8907-42010a9c0042", "comment": "Malware payload (DarkGate)", "timestamp": 1699541748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699541748, "uuid": "9d3724ad-2bd6-48e4-83ec-08dc1c69c8e4", "comment": "Malware payload (DarkGate)", "value": "1df0df7aa48965762597452d418db3f3", "object_relation": "md5", "Tag": [ { "name": "au3", "colour": "#BF8C9E", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699541748, "uuid": "3222a7cf-195e-4292-bd09-eadcb0ec2cda", "comment": "Malware payload (DarkGate)", "value": "52a1722f0614e1c88473f4240ca1f5ac06d952159236014ef721598bc0889408", "object_relation": "sha256", "Tag": [ { "name": "au3", "colour": "#BF8C9E", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699541748, "uuid": "2cf0e69d-0623-4f93-86a8-2ba005fef131", "comment": "Malware payload (DarkGate)", "value": "6b2137d66246ad3c994a28141736bc707c88184b", "object_relation": "sha1", "Tag": [ { "name": "au3", "colour": "#BF8C9E", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699541748, "uuid": "081b3c14-f2a8-4585-b23c-889d61c65190", "comment": "Malware payload (DarkGate)", "value": "ea2953d093675aa0795097488463f8460bb936afa64f762401443c0f28a1a201fbc079db8fa1edfa8e80f4a6d5058bf5", "object_relation": "sha3-384", "Tag": [ { "name": "au3", "colour": "#BF8C9E", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699541748, "uuid": "93dc1e85-eb50-4d74-bdc0-67ac4016872e", "value": "T1C5B4ADB444A591154E7BFD083283EF57287721DDC9E3F7AAB993600E688D619BB80FC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699541748, "uuid": "705006ad-c3ae-4ec4-9b4a-78c083a479a1", "value": "12288:VXKtYvL2LgNi7b02WtAO/Rvr5mZeQZ9o1BbKvsDA9Ul/:xKt/LgNoWtAOJvr5mZVSvA9k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699541748, "uuid": "e6ddf403-2bfc-4373-9ffb-7c878320a1cc", "value": 520358, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699541748, "uuid": "ef6454bf-b089-4ae5-a81c-affa344b9445", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699541748, "uuid": "069b8199-ac7f-4a59-950f-7ccd4c949037", "value": "totdjhak.au3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5855d69-7ebb-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1699505596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699505596, "uuid": "151d70e5-a9be-4c26-8daf-f380e726497e", "comment": "Malware payload (Mirai)", "value": "22936c561d0895809171b4f72c25fdfa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699505596, "uuid": "22f59bbb-d313-48a0-ad9f-2aab2043990b", "comment": "Malware payload (Mirai)", "value": "53853d0e0b50b146b001f7587438ade777ac06e5b066d0981256a1bff44ec791", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699505596, "uuid": "f389c652-12af-4563-9e5d-9f498f185dfd", "comment": "Malware payload (Mirai)", "value": "c394e267bf6d227487c434e7c76db483241eee57", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699505596, "uuid": "a204523c-be71-4bda-a343-5eeeded40f7c", "comment": "Malware payload (Mirai)", "value": "c133ac1c27089201f0a7811dc49e8647f38c9f19171d2569b5d71ec14a11ed3f450a5c7c65d8ffc369f9f8cfc8ff2921", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699505596, "uuid": "3c5ad7b2-3b7a-4163-b780-6fb67e814d4f", "value": "T138D35F86BF903FFFD81ECD3242A4DB0A129C590953A4AF7B6B78D404B65B11A59D3C8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699505596, "uuid": "82ba18c3-11ca-4ac2-920e-aa8396009dcd", "value": "1536:GcGHdmgE4CVD2pILP/+cyetaWLi5bDro+gpd5TQiG8ElB8WrX:GcGHdmgE4CR2pILP/+c+GiXgpdGYeX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699505596, "uuid": "bc2aba7e-1f14-4475-a9af-a5aefc1041ee", "value": 132256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699505596, "uuid": "2615c3b6-4864-4a54-8d2a-6c1641c7d870", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699505596, "uuid": "a3de3ea1-cbf1-4525-b36e-3e721def59e1", "value": "22936c561d0895809171b4f72c25fdfa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78aa4404-7f00-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699535049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699535049, "uuid": "f2aaecc3-dd65-437b-b3cd-ed6ca3333afe", "comment": "Malware payload (AgentTesla)", "value": "66c07fbf50ace1c7ba8fc4783b3c84c3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699535049, "uuid": "e603424d-2477-4860-871d-f6c4defe3dff", "comment": "Malware payload (AgentTesla)", "value": "538de2b03d110b5a4e88b93442e65449e70a8fd83f085309b114ed4fd7d859ac", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699535049, "uuid": "001499c6-f504-4887-812d-dabe134ebfb0", "comment": "Malware payload (AgentTesla)", "value": "583ccc5135526ff5ae3de6437644652f55789e90", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699535049, "uuid": "e9d2c120-b4ef-44b3-99cb-1c04a1d946db", "comment": "Malware payload (AgentTesla)", "value": "37de9530e158da76e77da9f183daef85ba97b936c8beaa6ee3fc0670cf2e59883a25a1e0ffab979adbef7176991ade4c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699535049, "uuid": "cfe0769a-4e35-4a58-8767-d79eacf9f13f", "value": "T109F49D893774923ECE08C63450E2DD14DAEB9D195BE1A20975D8B66C2B363FD4F236C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699535049, "uuid": "89ce24de-7950-4a26-9ed4-e33e2f745758", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699535049, "uuid": "78dc2550-7b93-44c9-8b8d-bafdc49fbc51", "value": "12288:D3SVbl4/Yw62oCti7nVtXSqohNc3p4FE6IrLa:1Qwzw3X8huAEE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699535049, "uuid": "561c542c-9d65-4eb6-b3be-c401ee9e5f5f", "value": 761616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699535049, "uuid": "a5635d7c-25c9-465b-8875-be065d84939c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699535049, "uuid": "646b68c1-c104-4610-84c2-15e003c94d64", "value": "QUOTATION_NOVQTRFA00541\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5157c216-7f4b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699567195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699567195, "uuid": "2fa01b97-acbc-4264-8455-44c39d35a59a", "comment": "Malware payload", "value": "865f21eecc77a217f10692696480bc32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699567195, "uuid": "d55c4f52-50cf-417e-941e-aee7004e774b", "comment": "Malware payload", "value": "53e49a02d05d19a371d8736eccc332aea3b0a998b8632de063b81949af09dd4c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699567195, "uuid": "06c88832-d8f1-453b-a1d2-96e2e1ab0eaa", "comment": "Malware payload", "value": "3cfce2cc5a37fc69acc58bf36f6fe2a57aee54e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699567195, "uuid": "72c8a964-6d72-432c-b6ac-9a5a1d1c0cee", "comment": "Malware payload", "value": "f825752fb9d99d8ad721cfa6ec9406310d1b87a0f1772ef39a145a76dca75cdfa61c2f8026e50b4bc1b7e642ffc7ec60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699567195, "uuid": "157af459-137e-44b0-8e6c-47e87ac3b7bb", "value": "T149B41252EAE84462ED7527B16DF702D30A357CE19CB4936E1B88986F0C73AC4A635337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699567195, "uuid": "5ea2cc0c-110b-4a9a-a2bb-915b85d1b4a5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699567195, "uuid": "898deed4-d22c-4f2e-8d3b-2a5cd70595f0", "value": "12288:uMrfy903MSADMjcqw7rMZLpkY8TUs2kuT+4+wSRKFSRAlfrm3W:Jy8MSXKro+YSz2ku6USgki1iW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699567195, "uuid": "e103dec8-4ac9-494c-b448-dc45a17a5dc3", "value": 523264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699567195, "uuid": "c98cd7fe-6986-4bcc-98d8-7881577fafbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699567195, "uuid": "401ba908-74c4-4280-a57b-18e92c0ac91e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b54f11af-7ef1-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699528708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528708, "uuid": "d790a857-7e51-4d7b-9cfa-e07ac2aa824e", "comment": "Malware payload (AgentTesla)", "value": "37dd500205913d92c499f00284b79fb2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528708, "uuid": "463ef265-f622-4b00-b639-73d1f283a015", "comment": "Malware payload (AgentTesla)", "value": "5406595543949dc773636b18db85053c68f5065b409e28d3c4e9b68cc374bfed", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528708, "uuid": "6ea867c5-8a3e-4b53-beaa-7da2f65bc9a4", "comment": "Malware payload (AgentTesla)", "value": "16a97a247ab539901d38beb6e3953aeb50a69e68", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528708, "uuid": "49d0960c-ae41-4f93-b639-b04b47369220", "comment": "Malware payload (AgentTesla)", "value": "b3f07330511a88f0c82411a2e94c919ad2583bff3e9589598f0d039771801b07522a1e8c56a0783463dabdf4498dc6d0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528708, "uuid": "e5817cd7-6496-492f-b566-ce0637f38736", "value": "T151C423E45CAB05C7BCB51937954AF07C68FE89E2FA402B9D606C24A2A07D7E127CF452", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528708, "uuid": "cf4bbbf5-c491-4b6a-9614-cdad1964463b", "value": "12288:gKfWLoNqD5PPJhmhVs7wEnS8wyrT7Am0a019RQs4kQsi+ks0PVy:gKfWkoZPKWdSjYUaIXr4kxaPVy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699528708, "uuid": "2c0c7a9e-3fb0-4db7-ab81-ce2b48424c03", "value": 580010, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699528708, "uuid": "8f33babf-2a81-4092-a4fa-36bb296f07dc", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528708, "uuid": "2c1dafc3-e27d-4cee-9a3f-6ed9d99c1962", "value": "nPO-2311.pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c2c013a-7f4b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699567240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699567240, "uuid": "f14eb180-3563-48b0-b3a4-4fbd90fbb189", "comment": "Malware payload", "value": "d18e71f95e817668a4d284b329ceccf8", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699567240, "uuid": "721abeee-b669-42a7-a9db-68460a34ef80", "comment": "Malware payload", "value": "5460cbebc25fe4c856afc5089702afaa90edcbc25c4980e021d1c59bf4e059ea", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699567240, "uuid": "e0010680-b812-4852-a36d-e272cb675b44", "comment": "Malware payload", "value": "b3288a795c84341362d3f115f75d994246fe6843", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699567240, "uuid": "0ddd8104-5fd1-49c4-91ed-27eee5464bb6", "comment": "Malware payload", "value": "a47ad12e996a015f787943bc5f38dd447e145265aa510e8332949c737444921e494b34a94c683183f278baca3a5e7c84", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699567240, "uuid": "fb8f494a-fd6d-41bf-a9cd-f10b072f8195", "value": "T10A41AC1017E20519E4B38A3CFCBA7323EA71BC159E178D6A06D850459862625F838F2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699567240, "uuid": "5bf73aed-a4d0-4936-a249-bc8445ee1926", "value": "24:8ykMeNkli9lK5WkCQAMWpzlNzuefwT4o02YikUdj8m2:8yDLcXdnRzlJu/MoT8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699567240, "uuid": "a8bb2e71-7243-4112-943c-a5c6debf7c5f", "value": 2041, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699567240, "uuid": "038c52b9-9913-462a-bf60-64cc517c8ca5", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699567240, "uuid": "11e92f0e-d297-42f1-b3fe-443a3f770438", "value": "ARTA.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "083219fe-7ece-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699513386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513386, "uuid": "23c911c1-2106-419a-99f4-507a60477f0e", "comment": "Malware payload (AgentTesla)", "value": "f944bb137667965f3f796c4bfbc19856", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513386, "uuid": "acd95b65-20be-4171-a38a-528d98e98f68", "comment": "Malware payload (AgentTesla)", "value": "55960f83e80db3dd7b148465a7536a180f2313088313574c7b5850e052138088", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513386, "uuid": "2c06dbc5-fe79-4b70-974d-9908b35af72c", "comment": "Malware payload (AgentTesla)", "value": "31508e0002b6a56fdc1ec7c8c914edc4ca980dd5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513386, "uuid": "31865e5e-5247-4bc7-859e-7cf302667231", "comment": "Malware payload (AgentTesla)", "value": "933d137cee82ab3e0566ea344a47ed5e8d6d10970f804f1b4e0bcd56d794dd0ca62f047a35594cc895dcb50d21d26714", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513386, "uuid": "79469e46-be82-4bf5-9970-b0b0663a0d8f", "value": "T1FCA5D703B9E785B1C9489F3AC5D70C2403E1DD406363FA1A358A3B59097377A6B4AE6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513386, "uuid": "8ea7ce93-c5c2-4532-9a6d-fc3ec04d727c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513386, "uuid": "959bac58-28f6-4d18-a2d1-45594f1abdbb", "value": "24576:5u4+Mmg2W0OqRWGacy8DL/2grwKur1gXUfsbhRU4Vvhb8/jEI8daeqGhdZZK:TBc9Jrw9r1gXUfKhRU4phaZ87qYZY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699513386, "uuid": "0c29f8ec-160d-48e1-be75-277515e782ef", "value": 2128848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699513386, "uuid": "81e32d44-d949-45f4-8c1d-684a5faf5807", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513386, "uuid": "3bdea4f2-4f4e-4bf9-92b1-9a934da558c9", "value": "QUOTATION_OCT9FIBA00541\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "186e3e0f-7ecd-11ee-8907-42010a9c0042", "comment": "Malware payload (PureCrypter)", "timestamp": 1699512983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512983, "uuid": "b0660275-9c4b-4d74-90a9-f079a55edce6", "comment": "Malware payload (PureCrypter)", "value": "5535ed8c586e63ce196a41423f6291d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512983, "uuid": "11b0657a-620c-4c65-9388-a66746609028", "comment": "Malware payload (PureCrypter)", "value": "5621a2d6847012b82db4adad0f958f834ea77f71e9f4946e87898468606fe111", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512983, "uuid": "8e352d1a-3cfa-4f52-bafd-df3e129fae19", "comment": "Malware payload (PureCrypter)", "value": "c4ca1c7d1a11de02bf63c52b66bdc4c4de71de5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512983, "uuid": "ec4384c6-4ecd-4960-afb5-7b9b4ebfd0cd", "comment": "Malware payload (PureCrypter)", "value": "f0d9e6debe187b52ee7badffb50f379b606da027de68211824ec1fa0b162e40cda5b17ee1d6ca97b7859ec7236fb25fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512983, "uuid": "7f4bcc60-d008-463e-8a79-4abfa1c5f78e", "value": "T14122F9946B69DAD0C45117B9ADB7CB612A79B767E8158F0F39C9720F2C037262433B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512983, "uuid": "efc930f3-a16a-49d8-9e8f-2bb2eb08046a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512983, "uuid": "a6f4e540-c08c-47bc-98f8-fd606c391488", "value": "192:PU78jVftRbA4dwBYiQLzZfiiLX2HS9yxSyrsRt8G3mSF6zEdst:PUQZbvdwBYxFiiay9ycyrsR2vZAds", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699512983, "uuid": "3943c512-ffd4-41b1-ac30-21b6ca88ab4f", "value": 10752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699512983, "uuid": "44903495-c52e-45b6-8ba5-454632946873", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512983, "uuid": "b0f71383-3d5d-44f1-8860-9dd8ac9e4998", "value": "Product Design 4.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08740c99-7f26-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699551182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699551182, "uuid": "dfee5837-02df-44f2-8bc3-71d0f5480b9b", "comment": "Malware payload (AgentTesla)", "value": "264d03e6115d6749e1508f7544325b3f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699551182, "uuid": "a1eaf782-5601-4fc0-9e81-ebf6a856e3a7", "comment": "Malware payload (AgentTesla)", "value": "5676a8c876afcd66ba3c8db800874ee23755aa13d3dd3c2b38fab82ca9b68d89", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699551182, "uuid": "69de7aae-2ce6-4b29-bb0a-352c25790570", "comment": "Malware payload (AgentTesla)", "value": "21c41ded903aae2921d9fa3920295579e80e3093", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699551182, "uuid": "18d3d606-bddc-4e7a-8553-e23277488b5d", "comment": "Malware payload (AgentTesla)", "value": "50250d465efadd843a0cf1cf682c2546e71c6ab35b125950f307d7920c79b364eb3b54d5289535c0dd5e3ae5e410ab48", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699551182, "uuid": "57bd2c90-3119-415a-8ae1-b7346db1a06f", "value": "T129F48B3D59AD123BC1B9DFB58FC5902BF1C4A9A77151AD78A8D303AA4342E56F4C023E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699551182, "uuid": "4a307720-c7a1-4fa3-b878-1d88e466d2d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699551182, "uuid": "fc8a4f56-3ef8-48f8-95e5-cbfff3d08dfa", "value": "12288:58YheNbIROfkRsBcRWdNRfeLsD8QSUuwvv5c1zI5sSk1z9QWBTBqiJFO:uY8fPBaWdNRfVD8XUbcD1z9QOB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699551182, "uuid": "35405ed0-1991-4c3e-a9a4-6873ed96ef5f", "value": 734720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699551182, "uuid": "3b8946d8-70ec-4a24-a595-63be5d9ac9e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699551182, "uuid": "a619379a-8679-4933-b0b4-e68437190db2", "value": "M-2931TNSP-830-00-FM-02045 -Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0456277-7ef4-11ee-8907-42010a9c0042", "comment": "Malware payload (Bayrob)", "timestamp": 1699530069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699530069, "uuid": "cbddd887-1464-4642-b11d-821c023e1465", "comment": "Malware payload (Bayrob)", "value": "9473bd4433746d292664eddc9f881ea9", "object_relation": "md5", "Tag": [ { "name": "Bayrob", "colour": "#35A062", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699530069, "uuid": "4a0c9232-b9e4-4498-93b7-51fbc70ce321", "comment": "Malware payload (Bayrob)", "value": "57262f1b49d6b396632b74c7890d1dd1885debf7996a1a14649ba09a015e1b0b", "object_relation": "sha256", "Tag": [ { "name": "Bayrob", "colour": "#35A062", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699530069, "uuid": "19afea9c-e678-4791-b413-0e5962a4204e", "comment": "Malware payload (Bayrob)", "value": "68e5c48cb0f4d46dae818e58925bdce36491d59b", "object_relation": "sha1", "Tag": [ { "name": "Bayrob", "colour": "#35A062", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699530069, "uuid": "874929dc-d720-4b4b-9bd6-f87722cabbd1", "comment": "Malware payload (Bayrob)", "value": "ad09bfed484c1f1f70b4e0806b06e648ab82cf6ccfdb574ed38cac2c141060745e637462e0a2e5bfa9a0bb8d001600c6", "object_relation": "sha3-384", "Tag": [ { "name": "Bayrob", "colour": "#35A062", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699530069, "uuid": "5d2cb50d-73ec-465e-8c46-ad5b04f04719", "value": "T1D3B45C11A583E2B3D40601F273BBE53A6A317D7D0B2689E3F7871E1589F21B19932673", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699530069, "uuid": "254e1a71-4cc1-4475-b9e7-04b94d7c7aa1", "value": "a614e5b78a137a2d99642ff356d59818", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699530069, "uuid": "e0bea52e-8fe2-4537-a5dd-82c8a0547374", "value": "6144:0rk5yrSwqlOntLDRozGLPNPBChIGlhOlEnQB70gaFt4oXzuPgbBZG6xF0+xkmKSR:0rPnzo0PyIGldnM7C/dZGNmNKSPuo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699530069, "uuid": "3a23ca28-5644-40e6-96f2-c3d6cecb99bf", "value": 517120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699530069, "uuid": "a7e72806-e04b-43e9-a206-8eca1ef40be2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699530069, "uuid": "e1335264-1895-4bc0-b0b8-8a2cf9385b78", "value": "57262f1b49d6b396632b74c7890d1dd1885debf7996a1a14649ba09a015e1b0b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a87811a-7ecd-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699513067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513067, "uuid": "25d4d1a2-6fa7-43c7-a988-98f8577aff3c", "comment": "Malware payload", "value": "9f03b1dfeece1ae39a7b6fc92f8b04b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513067, "uuid": "856208f1-52ec-4449-b53a-3d6338de457d", "comment": "Malware payload", "value": "573ad077c0f43e4e7a4b3d305c3912863a852b96f68b2ef58d02b35d2826af07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513067, "uuid": "e39cf7f2-d238-4c80-8f9d-cf3360da4915", "comment": "Malware payload", "value": "36590c4c80a1d4dd0dfe69ecd41f913aaf7ab230", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513067, "uuid": "ffaffb42-9df3-46c3-be57-b92ca152fbd7", "comment": "Malware payload", "value": "7f99ae6f52d62e7f53eadcd680840e98c7f7096cbd200bfe007998abbb0dadcae09482152769b661527de80cf9edeee8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513067, "uuid": "6b396276-c856-4d6a-8c3a-2c09a211b72e", "value": "T1BDE3E817B65A9AF1C2989F3BC5E751104774E581B693FF0E358E23CA18633BAAD03607", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513067, "uuid": "1faa3379-0717-4f58-a4d7-f4dd123f89b6", "value": "3072:U6cB9dLz9QGUVf87yLINHEnFVe2MbOTu+h5XvzKFXk:U6cB3z9a83UVeNOx0X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699513067, "uuid": "641be213-e08b-41de-a3c3-2b6281d23f55", "value": 151040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699513067, "uuid": "0c8fd1d8-5cc3-4bcf-b526-b533aaa37ab2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513067, "uuid": "4f7021f6-d169-4c96-be3b-70ff0a1175e1", "value": "Aluminium profile - Technical Requirement.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39e465f4-7eda-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699518623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699518623, "uuid": "0c08703c-d202-4b4f-9ed0-d9c7c6490704", "comment": "Malware payload (RedLineStealer)", "value": "9dce410cb9ee929b377929c4bb7645bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699518623, "uuid": "add9fcba-d50f-43b0-9d91-50f3d79fc69c", "comment": "Malware payload (RedLineStealer)", "value": "57eeede29bdc80a3242d23e5d18257e8fd08dcd7fc2a86ffed16248b61b3dd17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699518623, "uuid": "5b4653c4-b502-4f98-89a8-455f1eeaf06b", "comment": "Malware payload (RedLineStealer)", "value": "77945ab610e28ce84a72de56060f2edfd736a83a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699518623, "uuid": "97f66543-6994-4f96-a02d-826ee34d04ed", "comment": "Malware payload (RedLineStealer)", "value": "f7b3e90d22b35238d6c02a818422221fa8274c9a2c53caed4c5c8b64bb2d61c0d7968830298d7fbbeebb61f4324204d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699518623, "uuid": "3d44ba8e-0411-4a3a-84ac-d2034a98be8c", "value": "T114257B1934C44192DBE22ABE22DC3D27852DF0664F1914D381C42EF6EFE0AE16676E7D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699518623, "uuid": "c8a0dcf9-1a23-455e-83e4-0a544ba2e517", "value": "1d9d99952303d4d2f177266c5cd8e5fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699518623, "uuid": "310f47ab-5510-4f46-93c7-286f00f7ad2b", "value": "12288:phaZSLrhrBXkMmaVSuRWSjPUBNWPqwaBD/cVvyckW1YiLKLC:ppJrNkYjPUBkqbBD/ciWWLC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699518623, "uuid": "9b4f6143-f675-4861-954d-25f1e8d6498b", "value": 969992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699518623, "uuid": "2e0dce58-388c-43e1-b7a4-a602d4460609", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699518623, "uuid": "3e2fb1fd-1bf7-461c-b440-288a73ec89d7", "value": "9DCE410CB9EE929B377929C4BB7645BC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f50f7e5-7ed0-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699514364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699514364, "uuid": "b25418c5-59d8-4677-bb5d-e996bb973c65", "comment": "Malware payload (AgentTesla)", "value": "c1cb501b373cf4a9cffce742bca3d651", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699514364, "uuid": "065aa0d5-291b-4afc-9277-ca23ea6d18f5", "comment": "Malware payload (AgentTesla)", "value": "59e13c07169db3f0b03b9e79491a88bfc89684847b38048be5769499e4eae0f4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699514364, "uuid": "391a1370-9f01-48b5-ac92-f97ada92fd6e", "comment": "Malware payload (AgentTesla)", "value": "230a2fe6272fcd483660546e9c4f6425cee5e20a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699514364, "uuid": "b258e53b-4415-4ac8-9a2f-6d4cc732039b", "comment": "Malware payload (AgentTesla)", "value": "b9d3a57e1d3df1d1987fabca81951a57b1d084b26b110be9f2fcc2cda9b3a356e2d910e9abf2abf1c5b635c3b5ccf813", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699514364, "uuid": "efa061d5-1645-497c-a8d4-bf2b6492f136", "value": "T16D832B5B078A9937CBAD29F9D0A3714A87B6C322A043F787398C79F56913B8D39013D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699514364, "uuid": "c0851d4c-8ebc-4802-ae16-ac3027ca1867", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699514364, "uuid": "00c5b7b0-fd25-4060-a8c9-0464f934cc28", "value": "1536:Eq8vAOp/OQWeqpgH8QjaAZlqGKYxLV1okaBwFGimU84hqUQGgaRtgN66Q:Eq8vAOpmQL0gcQjaAFV1o5afhqRGgaDV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699514364, "uuid": "b85d2c1c-4f61-43c9-9be8-cde31ca69a91", "value": 83968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699514364, "uuid": "2b213d56-f2c8-4bba-94d8-8114cb8b9bc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699514364, "uuid": "d1d649bc-571f-41ec-a779-71e3014d6fd9", "value": "\u00d6deme makbuzu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ddb2e90-7ecd-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699512992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512992, "uuid": "d38f22a6-07d8-4f64-9c60-1dc0d3e8cada", "comment": "Malware payload", "value": "37ebb5c8ed846d9dbd53f1d940fdcd6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512992, "uuid": "3067c9ce-1f27-426c-a003-3b86fc441a63", "comment": "Malware payload", "value": "59e364842b47ecbbe78abaa11961da81e98ddf1c3cc4d6939ec72567ce515e80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512992, "uuid": "91376efd-8370-48b5-9a90-838cde503821", "comment": "Malware payload", "value": "5e8382616d200edab64848bd6b27b9903a062575", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512992, "uuid": "159ecb97-bb3d-47f5-8046-eefa6b7e028c", "comment": "Malware payload", "value": "849ab7080da28ad3f058229591ce6debc2ac5cdf034b664a54fac46abb5316d57cd179ddfa0dcf834bd3088591a90420", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512992, "uuid": "990f72fb-7bad-4585-bece-569b42383fa0", "value": "T17EA4015F9B908B58E2CE0370EB35A3504138E0B7A506E355BFC369933AB374E59259F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512992, "uuid": "4264c564-10b5-470c-8253-eb8ee38b2541", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512992, "uuid": "14e2b624-274a-47e4-9d57-2661db2292d7", "value": "12288:01fD2S+nR9PDPPniKVGMDclcejoeck6ceX108:YbzgR5PPiKVGMDTececk6Lq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699512992, "uuid": "0c5d8dad-fd8d-49d7-bdec-6612bab4693e", "value": 477696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699512992, "uuid": "0632993a-831d-4c69-95da-bb001dcc916d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512992, "uuid": "ec3929a1-3f7b-4a26-9fa3-2f9a67bc93e3", "value": "GHJ65435679800.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19a3071f-7f34-11ee-8907-42010a9c0042", "comment": "Malware payload (MarsStealer)", "timestamp": 1699557224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699557224, "uuid": "956042ea-14d0-406d-a8d3-1c0a47792d93", "comment": "Malware payload (MarsStealer)", "value": "aeb949cc36e15399cb610875bfba78b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699557224, "uuid": "c9c5269d-febc-4847-8cf5-4780b516f141", "comment": "Malware payload (MarsStealer)", "value": "5a438d8de6a838834da02ef14c29201e346df632a742d27f3d771b35e8210e3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699557224, "uuid": "e1ad79e2-906c-45df-8a28-5f3ee3e318fa", "comment": "Malware payload (MarsStealer)", "value": "1aba165ee41f3b0941e5dd27f4c67e749d4e927c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699557224, "uuid": "b2922666-2e0a-4cba-b290-da0b3b1b736e", "comment": "Malware payload (MarsStealer)", "value": "925fbbccb10feb0f98ca243dbcaef4fcaee1dd31b84a4f9cdc0fe4d603368473d6fce8aeb9f277a5f6c43722d507305f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699557224, "uuid": "a474c3a4-b08f-4b57-822e-a7958d290b3b", "value": "T173445C13E2E16C7AE5274E328E6AC6F8661EF9618F55379A13F4EA2F09701F1D172301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699557224, "uuid": "02541633-ecdd-48ea-aeea-3832d50c56f3", "value": "712435bb703a50bc9f31469ee9b68197", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699557224, "uuid": "b6a8af2c-25ff-47ed-ab97-702cc45f5bcb", "value": "3072:2GaMg8raBOZEcjot/AWZ4xxBO5ar4CZUs06frk2CtUOyx:HU8raBO3ot/AksDO7sQn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699557224, "uuid": "011f1eb7-4e23-48bb-b3fa-797c3bb0f298", "value": 267264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699557224, "uuid": "47796a8a-cfc6-45c3-97f9-190a544fb2f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699557224, "uuid": "9ab1eaa8-b7df-41f1-a8e1-42efc39794e6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd229f2b-7ecc-11ee-8907-42010a9c0042", "comment": "Malware payload (PureCrypter)", "timestamp": 1699512938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512938, "uuid": "33a2bba3-1da5-4d02-91c8-6c34b55298aa", "comment": "Malware payload (PureCrypter)", "value": "dde36d73509ebfc1942d8d1a9a7a18ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512938, "uuid": "7da230d2-84d2-4daa-81a2-1225241129f3", "comment": "Malware payload (PureCrypter)", "value": "5b57523c1c8b24f27219558f67916fa5b9d0861cf5adaa96aa89bd6799e6795f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512938, "uuid": "bd82258b-bd19-41d3-853e-298f06f112aa", "comment": "Malware payload (PureCrypter)", "value": "2fdbde1e1b1baa3c5f9fbf05e6a842ca70de1bc3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512938, "uuid": "a87cdc26-2656-457b-a58e-e29fa7d2776c", "comment": "Malware payload (PureCrypter)", "value": "cbbf2ad85b229d7ba62199f7c4fcc0bff46031178b5454202d4eb79b082bddd891227c3f9d070d497c9cfb8c77ab45b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512938, "uuid": "e1135bc7-78de-4ba0-b3e7-0febbb5123be", "value": "T11A52F784976CD6E3DC2B07FD98B747521A29F652A845EF0B34CD734A2D02712287672B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512938, "uuid": "32649320-17a9-476c-9d90-6f729e270d4d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512938, "uuid": "e6ff0a5b-74cf-49ac-a6a8-61a71603158d", "value": "384:OZ+yQE+GsL8o97COzsjuvHiiay9ycyrsR2vZC:OcydRQCzyfycyrsR2vZC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699512938, "uuid": "12352d46-931f-4f89-b7ab-15a713111f43", "value": 13824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699512938, "uuid": "231bdeea-1403-49a9-8bf9-1daac771f17d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512938, "uuid": "0337a700-2831-4078-94b5-b4ceed200890", "value": "Alloy Technical Specification.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec68d002-7ecd-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699513339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513339, "uuid": "4933d50f-f99e-48d7-b4fc-e06ad2765b86", "comment": "Malware payload (AgentTesla)", "value": "87884c194f8c86ee1c0f1aedb2b58a10", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513339, "uuid": "d290eeb8-e598-470c-8e8c-f736e9c5bd57", "comment": "Malware payload (AgentTesla)", "value": "5b65d86bf03c1b11caa6b77c3638761198913007dffa26824a0da346292977f7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513339, "uuid": "9096fce9-2f30-459a-b010-d01f55f116bd", "comment": "Malware payload (AgentTesla)", "value": "f0064f0b525d31cc983eba7b7a6f9d233a50b692", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513339, "uuid": "aa40eb13-1e4b-4b0a-bc14-ef85fff469ea", "comment": "Malware payload (AgentTesla)", "value": "7643eade2f64d1dff268b46f7b89bd30b3e7206e6b5f847c049d016c7553b57d073c076bc7c6dcefe9491ab9e2f35247", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513339, "uuid": "b8b015e7-3464-4bf5-ab3b-6321a3fc2947", "value": "T1E7F4DF097A785632DD08CA3418F66E10D2E7EE5D2BE1D21A25C8B66C1F326FD4F079C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513339, "uuid": "fab7ab5a-f9ad-4c83-8db3-af6d9ab1fbdb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513339, "uuid": "eb1c5c1a-fdfd-4b42-828f-2de12fd65ede", "value": "6144:YeGDEXIcD0B4wt5XAvYgwF8bm25kZvdvPcXZ9Lv/YkAsgITLR+UoRJdbwWqR2IFs:joEHDbwH3F8S2CzPEzx0lbnAJYAW1S6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699513339, "uuid": "b0385eb5-dcfb-4691-b929-7457b9e22039", "value": 740112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699513339, "uuid": "0fed9d53-899f-4757-84b3-4bc6a9da4307", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513339, "uuid": "fc5c5a6a-7e67-4aab-bd90-5fd0b807fd1d", "value": "Payment Slip (SWIFT)\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cad11968-7ef0-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699528315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528315, "uuid": "2e3d9ef8-5e1b-4223-8555-badf99f464de", "comment": "Malware payload (AgentTesla)", "value": "f6642b2b158eaa1b8bffd8786be2b75e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528315, "uuid": "c6349380-0b8a-4c5f-9206-d52fb86aa3c4", "comment": "Malware payload (AgentTesla)", "value": "5cbd1c5c0f6864d7ed32f40b7beb175af39a6c323b4f288c02a6563e46475c05", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528315, "uuid": "ae1cc7b7-de49-46ac-9419-d552d0b2d1fa", "comment": "Malware payload (AgentTesla)", "value": "4a3c8434f3e7b8fb6025379c72da343d0c8302e9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528315, "uuid": "b98ba58c-6b41-458b-9947-dbd142c5dff5", "comment": "Malware payload (AgentTesla)", "value": "d0c49c53947ec655daf3526d4808c5e909245522ed2054111df1e4315cb97db0b97b3d9fbac6a4c10be650fd7329e8eb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528315, "uuid": "33d321f3-aedc-49e7-b54a-f4c8fd3db06e", "value": "T117340E037E48EB15D1A93E3B82EF6C2813B2B4C70633C60B6F49AFA518516525D7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528315, "uuid": "f8a58671-b4ee-4f67-8ab0-876ca13710a6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528315, "uuid": "a2986237-329e-47d2-8507-3bd89f9ff7db", "value": "3072:9nvGyuy81IXB0A6eWbvVlvpaBWs+TTt9iDW5L4tfa5t:9nvGyuywIXB0A6eWbvVlvpMtg7UpfC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699528315, "uuid": "7a3acc3f-0a7a-4472-88f5-435983b15786", "value": 240640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699528315, "uuid": "335aad03-df93-4282-9005-5f7539168afc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528315, "uuid": "38cc000b-c3eb-4b76-9f66-6e4f3589b3a5", "value": "5cbd1c5c0f6864d7ed32f40b7beb175af39a6c323b4f288c02a6563e46475c05", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec7c505f-7f48-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699566167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699566167, "uuid": "04850f38-0a5f-4bed-90aa-0053032db9b1", "comment": "Malware payload", "value": "e65fe47ea98627812ec8467bd5d9e716", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GlobalNet", "colour": "#E9D9B9", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699566167, "uuid": "738393ee-6775-41dc-86aa-74e7b3d1e407", "comment": "Malware payload", "value": "5e2fcd97359d30805056f4c22e61a1996acb1038fa326fb74de9b3d563ee6ef6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GlobalNet", "colour": "#E9D9B9", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699566167, "uuid": "ee718f9d-5c28-4ee2-a829-04c272d5fbf9", "comment": "Malware payload", "value": "34642559c929283924e8468def71821dcf69395b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GlobalNet", "colour": "#E9D9B9", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699566167, "uuid": "3426ce2c-1d96-4c48-aca9-09fc9cd7d1dd", "comment": "Malware payload", "value": "2ceeb82552fd4b3c58c6aa9d778ffbc7b9d214d6b133cdda7e83288807310b494dbdcc90b99f832ce66840795b478aa6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GlobalNet", "colour": "#E9D9B9", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699566167, "uuid": "5aa60ff4-0d66-4454-b88a-b8d5a7f83e55", "value": "T129D73304D1B1159FFAEFFEFA65DAC24290D1738BC3F3A24630A0015A06EBD995E6C563", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699566167, "uuid": "02d3b09c-f55b-498d-b714-34133a56f0e9", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699566167, "uuid": "6f5f1efb-37a9-4eeb-b97a-bebaadce03b9", "value": "1572864:uxXGMK4XR3bLSCU/+6yoYC+Nob3OHzDCd5w7wkFD22lmoWKp:uxgYRPSC++6yo0Q+nCdPkFD2WmoB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699566167, "uuid": "6ea3fcce-8950-4397-8292-0a9101f44cb6", "value": 63341658, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699566167, "uuid": "1d5e236e-c60a-4a0c-bf0a-3234f4301e71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699566167, "uuid": "487a2fc2-e2c7-497f-b753-2f716607eaf2", "value": "HackTools.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e92b7f3d-7ecd-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699513334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513334, "uuid": "a6c3370c-409f-4e65-b024-40ab57c1481b", "comment": "Malware payload (AgentTesla)", "value": "4f988f286cfc78bcb002ff70835ecb33", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513334, "uuid": "cc037b43-3ebd-4601-8460-52d042e361f5", "comment": "Malware payload (AgentTesla)", "value": "5eb1f2253c052bafe834729d88bdbdcb4eaef70058456ff00517e7145aba7968", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513334, "uuid": "975fd861-0cc7-4c88-9a38-fb9b936d9c34", "comment": "Malware payload (AgentTesla)", "value": "5f0845a792b993eda9a75f32c57d3dab51b7e7f4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513334, "uuid": "398fb224-feed-4c47-9dcd-b462a64481b0", "comment": "Malware payload (AgentTesla)", "value": "047ed302aa271a94e7efe62ff1239b1e4f250affbaa81a19fc8f82fca67b60646687ea7f2f8ee6a008d8b31062342a8d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513334, "uuid": "d5544c30-57fb-4ff8-860a-c04faf1cffbf", "value": "T1B3F4CF0976749232DD08CA7419F29D11D2EBAE6D6BF1921E24C4B66C0F326FD8F176C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513334, "uuid": "0c63bce8-d776-4b52-8ffc-0ff8cc6145de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513334, "uuid": "11237868-eed3-471b-88f6-6a54aaaae03d", "value": "6144:YJ18hAF4N1lHzFM1lkeZWhFmE0BhdviCRh32YvUAWxS9j4Ce2k19mJ:YsAWL0b1sYvpR7NWxTCeVyJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699513334, "uuid": "e9227842-f117-46a1-9658-3d7dbb81a5f2", "value": 728336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699513334, "uuid": "618f21ae-1c24-4f56-a59f-5614c7341f3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513334, "uuid": "7dbe46e6-39bc-4054-bb1d-ea3feb9041ff", "value": "QUOTATION_NOVQTRFA00541\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52e019d9-7f0a-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1699539281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699539281, "uuid": "1af667f3-7438-4be4-980b-b144e199e814", "comment": "Malware payload (Formbook)", "value": "8b67efa864c1de942ec9d9e2a23b5a49", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699539281, "uuid": "d4d436c6-87b1-4917-89a4-9c41dd72283f", "comment": "Malware payload (Formbook)", "value": "5f1ea9476ea1d121241ebfe94eb998bb186a3e845b13e9cd171af269cf415902", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699539281, "uuid": "897396ef-d615-432c-8399-64874f77f38a", "comment": "Malware payload (Formbook)", "value": "42032b496972f05d4bb074bb0cca011045a144c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699539281, "uuid": "98510ac4-b7e8-4ee3-8748-9ff3d152a2f5", "comment": "Malware payload (Formbook)", "value": "206fdfcc6ae6209918dec615df5e932643bd14a6e1dad8a8473431cdda0ea296ed725ef5d2bf914f5494be7721256524", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699539281, "uuid": "82325894-5b5d-45ef-a877-8d7238340346", "value": "T103C49D0674C09036D8B325724AB9E6755ABFB8700B212ADF67DC0A3D9F349D16B3163B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699539281, "uuid": "cb2ca793-1187-4407-8bf2-f426785712f0", "value": "df500be92c6d64bd7e41946aae31befc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699539281, "uuid": "d899aac8-dd1a-4279-b5f5-04d84da86158", "value": "12288:BY688+CQdfnoP6GVgvlLi4LERAF8l5ByhWTs47onq0FO2g+9zN5:BTQdfnoP6GVgvlLi4LEGF8l5ByhWTs4G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699539281, "uuid": "a8ef52a1-dd61-42f1-8fc1-224f404ebb8d", "value": 568320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699539281, "uuid": "ae61eadb-166a-464c-8ae2-26fec56c4aeb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699539281, "uuid": "92562302-7af5-4249-b5f0-8d092e24992b", "value": "SecuriteInfo.com.Win32.InjectorX-gen.6192.12623", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ad2e937-7ed0-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699514356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699514356, "uuid": "f3947898-f7d0-49f0-bd78-38b67a8d0ee7", "comment": "Malware payload (AgentTesla)", "value": "1dcdfb138e43a5cf52f7773c61da24a2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699514356, "uuid": "1496a0ad-c158-4608-b9da-138e40bb3925", "comment": "Malware payload (AgentTesla)", "value": "606f875b96f202480af487ceac9c4ef73e0000b54c2e6524dd56070c0dc13268", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699514356, "uuid": "fe3104d7-e0c6-4653-b654-a05861d67a5a", "comment": "Malware payload (AgentTesla)", "value": "68325eca75dc7454a6f1c81f7f6fd4ebf1d87071", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699514356, "uuid": "340c7118-49c9-44ed-b9de-0345fef5c019", "comment": "Malware payload (AgentTesla)", "value": "dc1c9d4acd1336a56a7754184502676636a558763ba382839a9c251816ca8b315372929c19340b2f364d737c376c5a09", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699514356, "uuid": "09f5c000-de2b-4033-a029-d8a9e40684d6", "value": "T1BF155A082554E52EE52416F7088E5E0E1FAD5E273907F0F36C8DA08686F7EE370A99D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699514356, "uuid": "643ccd97-aef2-468a-83b0-66195cbbdfd7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699514356, "uuid": "be969f64-89c6-450d-9323-8ec3e90c075d", "value": "12288:+lqW8Zds9iZBi/H+oSzSRzaMrxd6eCXC8F3Ziysghnr:QdSdxBuS2paMrzcYyVhr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699514356, "uuid": "8b0527b7-c79a-41a4-a2aa-4cc1c64ca0d1", "value": 932864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699514356, "uuid": "204460f8-ac56-4f5a-8f86-3f3ee3bb45c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699514356, "uuid": "6b3d9f28-4a16-4a4c-8541-3c2cec02345b", "value": "DHL_CBJ520818836689.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41dac8dd-7f07-11ee-8907-42010a9c0042", "comment": "Malware payload (MysticStealer)", "timestamp": 1699537964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699537964, "uuid": "c40a8224-712e-48c6-8c42-a29505a3789d", "comment": "Malware payload (MysticStealer)", "value": "cb2a560f5a5b2033a7e89be878e44458", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699537964, "uuid": "b8ceddd1-8c39-492f-9669-bf2c271a384a", "comment": "Malware payload (MysticStealer)", "value": "607692690617dc53b548914308811fe6a89d9c681388bd7efcd858bb722e3eeb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699537964, "uuid": "d960277a-cf99-4311-acd2-a55eb58dc13e", "comment": "Malware payload (MysticStealer)", "value": "5fda6cce48bc2bf442b61c431837b3333cdc170e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699537964, "uuid": "7a946c29-9a26-4a76-8528-092f132179a1", "comment": "Malware payload (MysticStealer)", "value": "96f96d3b41059cd2ab45610a472058a4ae06576be33c8e2846bd701c4ba5faac0bd3606c443191e8cb49e6ec82b26728", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699537964, "uuid": "cb67b8fa-747e-4fa6-ae49-707b989ecdd3", "value": "T14D940217ABE88032D8F527B058FA03831B3AFCA14D78866B27955D5A5CB3AC4D47173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699537964, "uuid": "37906f89-f4c3-46d6-81f3-1702dcc527c0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699537964, "uuid": "7fed3169-2ab9-4abd-a02d-ca47d4aaa397", "value": "6144:KXy+bnr+Wp0yN90QElncnOyKz5fUT4Z9HDhAlFqyqDjF8rUQsYVCGhqb13pnEWmM:1MrOy90Pcn5G5fx1cWQsYMGmr/TL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699537964, "uuid": "11be453e-2cd0-4c46-b545-a4a19de3f5bd", "value": 441344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699537964, "uuid": "f7a415ec-6b39-4c6d-9836-1720f2cc8307", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699537964, "uuid": "e90cc47c-0a27-4ade-a74d-584ea7b90516", "value": "cb2a560f5a5b2033a7e89be878e44458.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f5c0c93-7ed0-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1699514337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699514337, "uuid": "d05b97c7-c3ad-4f5b-8e3d-d714afca0133", "comment": "Malware payload (Smoke Loader)", "value": "c81dc6e81881790221785f29a7cc34c8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699514337, "uuid": "b152bb90-9af4-48d6-8f48-89820512d9b7", "comment": "Malware payload (Smoke Loader)", "value": "60861a072ffc6b404ae640f7270e6d36afd5f4b0911866598be0800da4c16ab8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699514337, "uuid": "2c29d1eb-801b-44ee-9239-c8cff5158f3d", "comment": "Malware payload (Smoke Loader)", "value": "d3bf197bbfde783218550caebed44d94ee25b1a2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699514337, "uuid": "95ca9991-c73e-4f9b-b703-8c525e780f55", "comment": "Malware payload (Smoke Loader)", "value": "97220813526731f9ae98e546672f2c716531f926bd1b2b0edede6be80c04296b3f47f260891d4f817db2845872319b49", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699514337, "uuid": "a36ec9e3-d2b3-45d1-b0ae-767df48a0483", "value": "T1F9D602B16BD225167CE1ED9CBEF1DB7792747EA80B63B03C153891430A29DE8E343562", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699514337, "uuid": "ede06ce2-8865-4088-aba6-741040bf6055", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699514337, "uuid": "15536e0e-1e15-4acb-8a64-c46f4f07c0a3", "value": "196608:+OF6i+L8t1A2xz4I446AwIp47umu+Ju9Y8XuWv9iYDs50QTqOgY8fJHs:+ORjVF7pZzWu93fv9it50QTqO3+M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699514337, "uuid": "d77d9e3f-4ea6-4ad1-9a4a-e22851468530", "value": 13172224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699514337, "uuid": "10ee8158-2d78-49b0-ad70-87db470bc062", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699514337, "uuid": "3a1f5b5c-6460-4773-ba3c-2293a3ef295d", "value": "c81dc6e81881790221785f29a7cc34c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55aecfd5-7f47-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699565485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699565485, "uuid": "0a378647-6730-4036-8166-f08086992954", "comment": "Malware payload (RedLineStealer)", "value": "1f97dcd392862697d1a768bc1f704f3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699565485, "uuid": "abd4875b-13f1-43cd-8776-5bb9098fffe8", "comment": "Malware payload (RedLineStealer)", "value": "60aeb9d314969e4ab8acf4425cbfc680a537ee247b2b6aec84c4dc5ef9025b78", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699565485, "uuid": "106835f4-1159-4aa2-8c69-272421953893", "comment": "Malware payload (RedLineStealer)", "value": "35e584af8b8f98dc1ab4505a27a293e9c519e42d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699565485, "uuid": "5b4f8473-9aeb-495d-96ba-5242cab7b504", "comment": "Malware payload (RedLineStealer)", "value": "773e0344d15d8d7536e57d0a95531fef759fc3e6a1f55adf17a3c8bd66d9686c9e6c780980531e280e988646e468e60f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699565485, "uuid": "5946284a-2dc4-470d-8bfd-9668e1a8e63b", "value": "T15CB41292F6E890B2DDB5477058FA02E31B367CA1A978832723845C275CB36D8A635737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699565485, "uuid": "b7cb2ae5-21f8-4c1e-ad2b-5aded4a816aa", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699565485, "uuid": "3d2e2a76-ef33-4cad-90f7-f72e2b951857", "value": "12288:SMrEy90IBJ915doOwDIrY8TUs2kuT+4+wSRYFsrXqPRq9:2ybzYSz2ku6USSmTqZq9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699565485, "uuid": "a6684a19-6faa-4aac-8efe-dae47b3ea987", "value": 523264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699565485, "uuid": "5085320d-80bd-412b-bbcd-fb48b9d191f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699565485, "uuid": "c8656354-0ff2-4976-ae17-7c3d7f457c15", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ce61f76-7f3f-11ee-8907-42010a9c0042", "comment": "Malware payload (SchoolBoy)", "timestamp": 1699562141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699562141, "uuid": "410a908a-84f4-4d58-9cad-944e8e93eb0b", "comment": "Malware payload (SchoolBoy)", "value": "b46533ee942425c732bf376b34d1eadf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SchoolBoy", "colour": "#609074", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699562141, "uuid": "182ab20b-aa7b-4db6-97c9-6c82b453d2f7", "comment": "Malware payload (SchoolBoy)", "value": "611cad21a5fd2a344b7c6b45a78ac771df952c267812f894707d35fce0c59b13", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SchoolBoy", "colour": "#609074", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699562141, "uuid": "66c7d5e9-d268-4dc2-a9ed-9b47b7f3611a", "comment": "Malware payload (SchoolBoy)", "value": "27cff220f1dc0306be31bcba3bb2cb70357461cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SchoolBoy", "colour": "#609074", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699562141, "uuid": "59291462-df7b-4662-8e1d-7347b4f91826", "comment": "Malware payload (SchoolBoy)", "value": "d5403874c8b401f222cbadd65e49e06064c1c9d7f4076fafe93284b44792557950c6dc3e1b46ea8d8c00f12d4aad76e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SchoolBoy", "colour": "#609074", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699562141, "uuid": "915aa374-89ec-4948-8750-28452a57d0f7", "value": "T16116E122F248663ED4FE2A3A4463B550D93F7761A816DC9B4BE40849CF359816B3F18F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699562141, "uuid": "ca01982e-ecd0-4740-bf01-f5e61ed0b398", "value": "dafc225eed638e21ac8d84afad5d916b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699562141, "uuid": "f5218b2f-60fb-4639-852d-a0153a470e51", "value": "49152:7ayH8UOV1AWjIBCefgCs6Xaxp0M9RDFDW/7jhhTzvQkw7HeP5hz9sNiiQXiyliTa:7dOVVIBrs6upzpSxRzYNHePLxjbyyoaZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699562141, "uuid": "f3f70592-3de0-4136-9aee-9d6d661869b6", "value": 4044800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699562141, "uuid": "3179593e-b2bf-4be9-8529-089f674ee241", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699562141, "uuid": "78edf8e9-3c61-4ef5-a2e8-1be91600b05c", "value": "611cad21a5fd2a344b7c6b45a78ac771df952c267812f894707d35fce0c59b13", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64e20df0-7f4b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699567228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699567228, "uuid": "f82f9413-af66-4aa7-907b-08a1d4810752", "comment": "Malware payload", "value": "d19ef43d2bfffa01bd0cc590d18286a6", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699567228, "uuid": "cabdcf19-a45a-4c06-ad7e-db643af91ff6", "comment": "Malware payload", "value": "61370d0ac56f73321c11876424ec75e2740d6910ff53b0791f0560c72d85b330", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699567228, "uuid": "ce385d62-0bf4-4e66-bb37-ed646f00fb0e", "comment": "Malware payload", "value": "b9b6bca8ce81fc956f78ad45c59b56c14ab7a572", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699567228, "uuid": "b0f235de-8765-4fec-ba34-f3ed238ddb21", "comment": "Malware payload", "value": "cc505b9515765a5f352e8e36fdb2cecd0e84f337fe7819b5afa846bc4b6ec3079f63a05a50c233e6356bc697f3eb97c4", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699567228, "uuid": "1218f4d0-c019-46e5-a495-9a4fadfa360a", "value": "T1F941CE2017A20519E4B38A3CFCBA7303DA71BC21DE138EAE06D551455C66615F878F3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699567228, "uuid": "8bef2dd7-ba8c-4d61-b24b-b924c8a203ed", "value": "24:8ZfNkvw5cWGlKdSWQ8ECQAMWpzlNzuefwT4o02YikUdj8m2:8AvicW9l9nRzlJu/MoT8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699567228, "uuid": "10d09fb6-71e6-4085-9c13-f4485a3e7246", "value": 2041, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699567228, "uuid": "93d91e85-9823-49bd-8f24-842443a5037a", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699567228, "uuid": "5d9819b9-9e81-4ac3-93b3-530dccd8f789", "value": "SIGNAL.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d3eed89-7f4e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699568477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699568477, "uuid": "a8fa67ab-b503-4977-9fcb-d6703eca495b", "comment": "Malware payload", "value": "f6ce63ed5231cba10cdc985e60cf151f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "executable", "colour": "#8C6D3A", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699568477, "uuid": "3b031ea3-ce6d-419c-8100-b3a420470d22", "comment": "Malware payload", "value": "628c1c8cd9ba30968ba9b8294bd113415f0618aa8b7c7a55307ccb176df9a02e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "executable", "colour": "#8C6D3A", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699568477, "uuid": "411eb951-dce1-4ff1-8236-630fd838be69", "comment": "Malware payload", "value": "15fc370f4963fe9e35948e6cb315ef77d76b01f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "executable", "colour": "#8C6D3A", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699568477, "uuid": "d6d9067b-9920-443f-8ce6-390e8796ee35", "comment": "Malware payload", "value": "7af31b5baea1c60c2262a36b9e4ebe9aa5b9553bb4ad964ec356733f2905aaf4e2c5ae8cb22a03fb62f8fc678d0998b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "executable", "colour": "#8C6D3A", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699568477, "uuid": "91d36ca4-94f9-40bd-ac60-d75c177179f4", "value": "T128868D47EDA546A9C1A9A230C9B2D253BB71BC485B3123D32B60F7392F77BD06A75304", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699568477, "uuid": "639f092b-1750-4c91-8d3c-a7ea3222647b", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699568477, "uuid": "d5073d33-615d-4cee-8d28-2fac9cc5c9e3", "value": "98304:jLjm+SXfDusXQcMEib/+CffDSfv6IjXSJ7+YMKj2y+qPoKrEv7:PLCfDusXDidSfvNF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699568477, "uuid": "e68e074b-5d67-4127-b38c-c69165595713", "value": 8311808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699568477, "uuid": "3b9bdef4-0654-440d-a0e9-934afc29d822", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699568477, "uuid": "9eeb9e4b-2fd8-4c77-a6aa-b98d4738de16", "value": "NoBackend.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcaa170a-7ef1-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699528721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528721, "uuid": "ffc63cde-2a5f-4155-9e7e-a197e7bedb7e", "comment": "Malware payload (AgentTesla)", "value": "7e58ac835f6b6269bf60838fa20fc637", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528721, "uuid": "6786e2e8-4747-4d1e-b16b-647d75d93545", "comment": "Malware payload (AgentTesla)", "value": "6395f4518c3a7a7673a31fe36b8bae4835ae556688891d8217c099dddd0c5883", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528721, "uuid": "b01a92b3-e9d6-478b-887c-ded56823aaa9", "comment": "Malware payload (AgentTesla)", "value": "c677177eb1d1d06796196a0ab36fdc1a73b288af", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528721, "uuid": "76ea50f1-a326-41dd-b07f-1362e9a0f3d8", "comment": "Malware payload (AgentTesla)", "value": "1688d4398d39f6388d651320866e63cacd0a2562ab0c1f90edc82dec4c1287295d02a031b05459b9dea8fe7062fcb087", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528721, "uuid": "a74d481e-b50a-4bcd-8c98-a6bfc04705b7", "value": "T1BDD423076249F3EBDDF887B24561AE8053B59D5B8060F6385DC874CC6B297BC03A4B9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528721, "uuid": "84bda0be-8dd2-4f4a-b17a-73d23d00bce4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528721, "uuid": "4ae554e4-ce6f-4c8b-8e03-02466a90afbe", "value": "12288:CzlR4bcqjro82QGNZVOQkT0jQ4tUAADUcL7HIy/bgH2F6:2DOvo5/4QX5ADUC8WF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699528721, "uuid": "6f329846-89c6-4b8e-91be-9535823b21e6", "value": 598528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699528721, "uuid": "391f1902-aa3e-41c1-a8f3-adb09a220f5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528721, "uuid": "e49119eb-af27-448e-9d01-83d1467d6bb0", "value": "rPO-2311.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd23d8f7-7ef0-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1699528319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528319, "uuid": "1cc0245f-cab2-4e4b-a755-5261d34f910d", "comment": "Malware payload (Formbook)", "value": "dcc0b51454246558ae791b23e7c432ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528319, "uuid": "97ea2649-9c84-440c-8a80-35a09b496e23", "comment": "Malware payload (Formbook)", "value": "63f6026d12f89887e771e6f8518665353c55158a3d9bd17afb9bd9cd3ebf4f9d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528319, "uuid": "c4a2f090-80c2-444a-ae40-85c065c13681", "comment": "Malware payload (Formbook)", "value": "c7e71d3e1704e5f54db2cf20e0f9e6491a83f849", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528319, "uuid": "a0999629-983a-4cfe-865e-5d3cffdc41f8", "comment": "Malware payload (Formbook)", "value": "db7a3fc7e53b657a15bdce367c1fe91848aa0cdbe5bc497fb4c53dd3346d53b3c2d1f46accd32216713676ed22c335c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528319, "uuid": "a8556c8c-438a-4de2-8d07-deace0be375d", "value": "T10705AD232E797B66C93A43F34554414C43B66E5D3CFEE21B4D8EB0DADAB5B400A42B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528319, "uuid": "63bdac2d-4c01-473c-9cc4-4faad3194ff0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528319, "uuid": "35d55d47-dd0a-4f2f-a77e-ee53a2d4b880", "value": "12288:0VpBKPEDh+cRbSLFDEjf/4et0hpbK6Jn+UlvEUNZpYmI5q78xbwQd:glbSLFDqf/Ahp/nFsUBYxM78FwQd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699528319, "uuid": "8157302b-b8dd-4155-ace5-afb95bc2eee9", "value": 868864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699528319, "uuid": "2ca4356b-8949-404c-9529-367ea917b666", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528319, "uuid": "bae17ea1-bed4-4a71-ae4e-a839ae842cb2", "value": "C65v45yjPwh3N8G.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72e80fcf-7ef0-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699528168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528168, "uuid": "b2a4a14b-4af6-4492-81a4-b8786d18fcc2", "comment": "Malware payload", "value": "73947b33d4e846cb4ded0ea57bbabe65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528168, "uuid": "fa09a13e-2626-4306-b2a1-e038fab0e257", "comment": "Malware payload", "value": "645af97ef621390ec7d5570820bcf92909b99b82ae0405272f28e1f25fd865b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528168, "uuid": "f6f998f7-b98f-4980-a96a-7d1e287f3d88", "comment": "Malware payload", "value": "6217adb7393748f3389b7e345f5c2ac04174cf99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528168, "uuid": "eea0a1e2-dc00-4ad9-a6cd-b8980c2b837d", "comment": "Malware payload", "value": "5c7522d9a4e4e3c766e3725d3295df666c48fa09f83ee4df4a383defe495dad020411644d343c4e8a03aa5779e1aac7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528168, "uuid": "32eccc29-6980-40e2-bfd1-1721bc0f0a04", "value": "T126847C15F1C0E030D1A251794A68EB2346BDB6B027768ADB7FC84E8D47A84C17BB3B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528168, "uuid": "8ac7888e-d420-45b4-afca-6e223a6feb56", "value": "aaad2ec522b6b7b2f3a6e5d0b82dd64c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528168, "uuid": "9ee42172-2f71-410e-ac9f-68052061fe3f", "value": "6144:FyekZDKDUFN9CNV2xxZbjB5Hl8mtInmyq1SraJVrYZ+T6CGK/iLOg:FoKoCV2xxZbVH8mInt2JmZzfLOg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699528168, "uuid": "57c63bbf-1112-4792-9a60-778ec8d34f85", "value": 372736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699528168, "uuid": "088a51fa-3f60-42d2-8f30-b23513ac17c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528168, "uuid": "1ac948a3-1e0d-4c86-a902-3b59a3da4a21", "value": "645af97ef621390ec7d5570820bcf92909b99b82ae0405272f28e1f25fd865b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31b8804d-7ecc-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699512596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512596, "uuid": "82680619-f2a5-4bfe-87f0-19d41ebefd58", "comment": "Malware payload", "value": "958a55d83e7b2834115df1fa7fe26a85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512596, "uuid": "2142807a-c2de-4e15-882d-2fc029f02228", "comment": "Malware payload", "value": "6789348c0f437eb615c0f47866f44567cbb599add018c9d9bfcc4d3c20c3aa09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512596, "uuid": "b735e423-1a18-4b98-871f-1147e6bd6f33", "comment": "Malware payload", "value": "593fa02be5c83867dd595692b22a9096ab19e577", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512596, "uuid": "68115b35-0748-4693-bc42-77bc66ebda36", "comment": "Malware payload", "value": "b6a45d14d32eb4a66167f9811b7a419a3c2fa7a2fffddd396931e1dd898e585ddce52685c3789264eaebe5b8e48d3d69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512596, "uuid": "27789ab2-ba25-49c1-9d73-54a5cbc6c3ce", "value": "T16983199A07C8A93BC7DE19FC94A2628A8FB5D3266083F787798C79F4541338D29057D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512596, "uuid": "a0e0a1c2-8965-47c3-8db2-5c2cfd9cf764", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512596, "uuid": "aa893011-e5eb-4883-be52-a990c4f5fbae", "value": "1536:mSvsqvvdQ2Eqpl/8QjaAglaLQ6nnvfWmLvWDS3nWaktgNaC6TvvL:mSvsqvlQF0lEQjaA5vfbXWaqgNazTXL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699512596, "uuid": "6458e157-8712-42e1-aabc-2c26ff4fd621", "value": 88576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699512596, "uuid": "e2cf44b4-88e4-4787-9f86-72001e2b02e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512596, "uuid": "e14eb4af-dba3-4278-a9ca-86802bcc85d4", "value": "Company profile 081123.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c15a2d7-7efe-11ee-8907-42010a9c0042", "comment": "Malware payload (Loki)", "timestamp": 1699534088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699534088, "uuid": "62eb4117-eff3-4b29-8cab-064c01a4c171", "comment": "Malware payload (Loki)", "value": "706d8586ce2f975733184ada10e3610f", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699534088, "uuid": "dc5472af-0ba0-4ad9-9115-115c1b4fdac0", "comment": "Malware payload (Loki)", "value": "67da47b6e229d42804f9930bf98e7ada1594f872087252f1a4b15993fb398ce8", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699534088, "uuid": "9ab83ccc-19de-4c56-a633-5158dd80af55", "comment": "Malware payload (Loki)", "value": "4dd54caf3f8abc039f6a98bb9b42a3b75858f940", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699534088, "uuid": "1694d18a-332d-404e-95b3-75b92ebcd7f1", "comment": "Malware payload (Loki)", "value": "304ba00306fbc27464da80aa4ff5c78adfa17003bf282fa4f4e390ef948181682670f40cff14e1fe075e50e842a75980", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699534088, "uuid": "25f6a7a5-b992-4567-aa11-5f4aafa7187e", "value": "T116635DB2EF58151A4D4F27DEFC40C88186BE81692522016AFEDD53CFA10799CE3BDB19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699534088, "uuid": "23d23df3-873f-438e-a2a4-fb160eca4dce", "value": "1536:z7JoyGOJS/lFygnJ9MIwZNZQ+uLDezOprBvkG2dDv:z76XOJolLnJ9B03zOprBvyb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699534088, "uuid": "da402878-f157-4e01-a18a-35febbe907e3", "value": 68279, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699534088, "uuid": "00b577e3-ce92-4e02-932c-b8ad6ef46657", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699534088, "uuid": "7752a4a9-b40b-4237-8551-3e149cb63562", "value": "Solicitud de Cotizaci\u00f3n Urgente (202311_08432UGR_ES)\u00b7pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73f689c4-7f00-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1699535041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699535041, "uuid": "8e103424-b483-4cb0-91be-72c4d1e67475", "comment": "Malware payload (RemcosRAT)", "value": "a5eb1990fdc304fc6ec666f2dcedb815", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699535041, "uuid": "d36504a1-f877-4f6a-8b66-8aa845221c98", "comment": "Malware payload (RemcosRAT)", "value": "67e80f7222cfbc2887d71c6f0d27821e42aa7aaeb84315233cd9efa42eb4550b", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699535041, "uuid": "facd36c0-4649-4bf5-b46e-7d8ca3729327", "comment": "Malware payload (RemcosRAT)", "value": "1ca27ea3c48acb453e28a519d2eaaf7477b060f6", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699535041, "uuid": "f0309672-ef61-43be-8e68-2383e8a00a86", "comment": "Malware payload (RemcosRAT)", "value": "50289fa88312a3393281c806af63d5e0e410d7ea502f0082412a4c48f07177239e40b6e93167fcb230c401f75ee3f1b5", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699535041, "uuid": "804df99a-2907-4dd8-a25a-4668b22322b1", "value": "T170B2F18D588A4D5FE0E43E06A35BCB7F580BD4A09BD2272B3DA0A6C01548CEC9329DB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699535041, "uuid": "c9438d4c-81f0-4b94-a2a6-2c14301008c7", "value": "384:lQptL4rkN9f/sYWRDXacYnWEDyPVKhinADwjTirTYJJK:lEZZ/2RDXyWEDGpnA0jTOyJK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699535041, "uuid": "cce55f98-07c0-43ea-befc-962a9ee97440", "value": 23547, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699535041, "uuid": "5a3ef6ff-5d62-4575-9002-488d2d8f4710", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699535041, "uuid": "4b7f34cb-1a8e-47de-9115-37008232a866", "value": "Confidential agreement form_11_8.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "134ee1b7-7f37-11ee-8907-42010a9c0042", "comment": "Malware payload (zgRAT)", "timestamp": 1699558501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699558501, "uuid": "dfa28d4f-b260-4354-8443-640c3c678fec", "comment": "Malware payload (zgRAT)", "value": "b2656998d9f4a3c7bcb0f92243b144dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699558501, "uuid": "93f3e23a-618f-479f-adcf-6c6eebff1f94", "comment": "Malware payload (zgRAT)", "value": "68899fc05a68abeb8085dd0dc8c264cfa2dd2f8a091e2956e3179c7ef709820b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699558501, "uuid": "c18c7acc-fa9a-4746-a6c6-f023ccd638a1", "comment": "Malware payload (zgRAT)", "value": "65cc8ecfcb2edd510c5c2ba3a05b4b69506d3c00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699558501, "uuid": "7cc4369f-0c5a-4432-9965-fa401df37944", "comment": "Malware payload (zgRAT)", "value": "ad9589ef8863072eb648e8f4002705d0f1f6f7f79c3fc0ea1600b90f2d43336964b2fadf0aa73758825bd4b19cf35b9d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699558501, "uuid": "62b864a5-034b-4d88-9584-787372432c6b", "value": "T1A9F5E61D3E660C2ACC5D12F1CC1E75CC6E93EC8A5F19909B29C678DF8A3D18B784D296", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699558501, "uuid": "7f232a42-5096-4809-a03f-30a6c817501b", "value": "49152:ZdnbneYP07H9IPY+ki70UIeuW6Qw24Gwz8Zhg7aIC8yzwzJDmIya7i6s+M+KI+vq:CoZBbjJwOwb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699558501, "uuid": "be55ced7-3a24-4f2b-9c84-2381fbf78437", "value": 3604136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699558501, "uuid": "dba7bf4d-650c-44e5-b192-76765f1aa542", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699558501, "uuid": "9d1b8b63-a8d4-4d73-a8c9-2517062146ae", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa3de19a-7f34-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1699557600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699557600, "uuid": "79892e81-cdfb-4436-91ec-0232ddb31b84", "comment": "Malware payload (Formbook)", "value": "5af57da41949a85b712ccad1a3af7e75", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699557600, "uuid": "0a29b288-ca34-4ce2-8bb2-35e14032b13c", "comment": "Malware payload (Formbook)", "value": "690bee83c4cc1551cb08baecc2ecc7c29b2a0120e881d64b1018f17bd13f1677", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699557600, "uuid": "aa561823-6e1e-4fc6-8a8b-836e7c01db4c", "comment": "Malware payload (Formbook)", "value": "3ecc04f7082601340659304b6940b475b48b3079", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699557600, "uuid": "5429d6e1-cd88-429f-b092-02a5a7a4bb71", "comment": "Malware payload (Formbook)", "value": "06a1a988b08913718084fc159abd9acd2147f18cad498c4a4d99f6a7b163ea4946599382ee4fc59285cff605f85053d1", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699557600, "uuid": "9fb30f0d-ef12-48d9-aaea-b00251c84abc", "value": "T1D6B4239D524FBC9B63965B8EA304CA724FAF7B5135B43EB68B080C03A0E2D65D9F0C54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699557600, "uuid": "7e23408b-5440-4f16-9ae7-04eba1fac847", "value": "12288:451WKKWY1FCt/7MRCgpPbOR4Ouv1lIssEh0rNAGRdZM88wH7bvU9Y48:451Wp1FCB7MAWOnglwrNAMZM88wPvQ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699557600, "uuid": "e0835aa3-037e-4681-9473-545249954cea", "value": 538448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699557600, "uuid": "d4e0618a-ec6e-4119-a23f-8ab6608d47b8", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699557600, "uuid": "26501f0a-90fe-4f6e-8c80-272a10b3d829", "value": "Receipt PDF.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb1c786c-7f54-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699571319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699571319, "uuid": "c7d03bd3-c503-415a-9291-49103946d328", "comment": "Malware payload", "value": "3eaa3e4b90437453ed850d31342bbad6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699571319, "uuid": "d750e8c9-4ab3-45c3-8e88-c854ab9e4fce", "comment": "Malware payload", "value": "6acec638139edd7e6dab9756147099f8f549d8228c9b72ebe6b1d0d31d99fede", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699571319, "uuid": "a31a4c67-7a44-44e7-9290-3496e1d71203", "comment": "Malware payload", "value": "586c519b82f769a800b3a26b86110906aa0a1007", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699571319, "uuid": "b5461311-cb19-411d-bbd9-9b051e64c0f2", "comment": "Malware payload", "value": "9b4fc4c054ea0f51cd75519f31c50344adf9992236f3b5234031e9002a102d0fcd960055111ed015b65f2749e82ab47d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699571319, "uuid": "30f7e57f-de1e-4a9a-8ed7-0235d5e258c6", "value": "T148B41246EBD88172EDB02770ACF702D30F3A7CA595B8835B2645995B1CB3AC49532737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699571319, "uuid": "4d228560-618f-4523-a929-0ca07f7455ca", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699571319, "uuid": "55a145aa-5e55-40ea-b687-927abe47c2aa", "value": "12288:3Mrfy907RBin0W0pcC9jFbg1wY8TUs2luE+4+wSRGFD90eKJF4Ju:0y0RBfj3YSz2lurUSkgFUu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699571319, "uuid": "e60b168e-3612-446f-95c5-f47bf8bfd893", "value": 523776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699571319, "uuid": "44e32476-3cc2-4c4b-b165-bfd8ba655e4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699571319, "uuid": "f793cf6e-769e-4dea-a120-d14260a883f3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bed7994-7f02-11ee-8907-42010a9c0042", "comment": "Malware payload (Heodo)", "timestamp": 1699535967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699535967, "uuid": "3b6f5d80-b071-4967-b790-13ab3f641a05", "comment": "Malware payload (Heodo)", "value": "07463060b7891e1bf9f3c33ebb6309af", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699535967, "uuid": "c279c84b-1a64-4ca4-8952-9fa3e1b14d43", "comment": "Malware payload (Heodo)", "value": "6bdbcee2804eb7f3007fe8c0396944619a7652b4bd0149c4edd7d8a11aa4bbb4", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699535967, "uuid": "a6f5b10f-3dcc-46a8-b11d-716a1e70aaf6", "comment": "Malware payload (Heodo)", "value": "5da4b584490670d6345dc35c462eb2d6bf4ea54b", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699535967, "uuid": "f78dcca2-e61f-486e-9128-84cc4ceb1b7d", "comment": "Malware payload (Heodo)", "value": "ece4784f886f18db4d7afd695e8c110a3cf141f647118bb7d1d0262148c1b94146a06460f9d43084c68f2c502a0a7b03", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699535967, "uuid": "9d27679f-8536-4a72-af88-106bd2b757d7", "value": "T14C446C13D2E17C7AE5274E328E6AC6F8261EF9614F5536AA13F4EA2F09701F1D272311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699535967, "uuid": "52bd45c6-52b4-4930-b238-981ccc0cd0e0", "value": "4284d1855063ece17f787eb23700c8e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699535967, "uuid": "75d150f9-7718-413e-98cd-874b5e3ee80a", "value": "3072:oj6F2gfTEPy8j3zFHieJAVi7aMf+QgU7r7cgGliN5JFyjOMx:u/gfTKF3zFHihViOsgUw5+0S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699535967, "uuid": "ad48d0b6-58cb-4393-912e-cc1d94632243", "value": 269312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699535967, "uuid": "481f4da7-11a3-428e-8add-481ff7189251", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699535967, "uuid": "ddd82083-3a6e-4217-a292-ca2760447df5", "value": "SecuriteInfo.com.Win32.TrojanX-gen.22454.32222", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "003d5bd6-7ecd-11ee-8907-42010a9c0042", "comment": "Malware payload (zgRAT)", "timestamp": 1699512943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512943, "uuid": "de8ebca2-f8d7-4fe8-8d98-9a405e47af7d", "comment": "Malware payload (zgRAT)", "value": "762f51d3f7c9595f3980b779a71a4647", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512943, "uuid": "aa1e7e3a-620b-4ff2-be6e-c6af27897735", "comment": "Malware payload (zgRAT)", "value": "6d2808b4f1a4c83271d6f37427be08e4bd7c0db64a41fd8a7237076c6bd3c15b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512943, "uuid": "01d5091d-c092-441b-9193-746f1d2e923a", "comment": "Malware payload (zgRAT)", "value": "92c467aa0d69f4a88b9e0d96f97aba723886c82c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512943, "uuid": "d59aba24-138e-47c7-bb08-908de7df21db", "comment": "Malware payload (zgRAT)", "value": "f1830d132358dd18b197c6489171d731030eccf5779997412033de63a63515f373c74e81a185525e9613bb71c2456780", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512943, "uuid": "b191c64b-1b6e-4e5a-9ddc-7f7d0a9e0062", "value": "T1F2B218485E0CD453CAAC467DE1B70B5A57B4DA2BF852E74F6C8CF20A68433C149926E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512943, "uuid": "5ab94c08-1a8d-4ec7-a614-39f20dad5ba1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512943, "uuid": "405a9f04-5508-4f17-87ac-a05307293a37", "value": "384:t5vSuRMdxKkFCEv0lB69gj32gmyl/3sx+skcT7AsUpayaKRmiiay9ycyrsR2vZT:txSSMbdMi0mPyVpMUEVKRsycyrsR2vZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699512943, "uuid": "f595188f-112c-40b4-af63-bb17add5b955", "value": 23552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699512943, "uuid": "dad9c41c-5ddd-4c3d-b7aa-02f1e9ddad4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512943, "uuid": "72c5dd20-993e-4269-9f32-0b40c624ed36", "value": "Product - Design - 15546.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8314c368-7f00-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1699535067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699535067, "uuid": "45ace81e-4bbf-474a-8c14-9e0ae2fd53b1", "comment": "Malware payload (SnakeKeylogger)", "value": "61abb1054c7ee356a5e3a09df1278988", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699535067, "uuid": "5dc5395a-9614-4d2c-97b2-78c9bd8e0046", "comment": "Malware payload (SnakeKeylogger)", "value": "6d6134ebb439c83a08371943a1c5bf18aad9958d83494d63caa6cff80e77e6d1", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699535067, "uuid": "feef88cf-1fd8-4b97-8e00-0cd9887e72ac", "comment": "Malware payload (SnakeKeylogger)", "value": "62b496da5a64f25cb0e135c453d47290de1def67", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699535067, "uuid": "90733b3f-f407-4c90-9aa4-9b0fc35ac5eb", "comment": "Malware payload (SnakeKeylogger)", "value": "fd9a0298740a39421fe2d8715008aefa5c123e1bee2bcbd86b929ca742df6e95a85a308b4ac2e1c3d20447b019d6b593", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699535067, "uuid": "49b263b1-a739-4f22-bfee-2536da570e9b", "value": "T16C5423ED4D68979BA317069B3D7AF305F22179130B0B7B39A8F954A14F09932E4DB4E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699535067, "uuid": "6358e8b8-a9dc-4720-80ae-a21508559a9c", "value": "6144:pNdDyrDIp3r9ePGxHfj98fIW+DXT/737Xs3wYf0xcqQG7V1yf5zVuuB:pNhyfIB9ePGxHE+zvI5wQoCcS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699535067, "uuid": "b5e37acb-bf51-4647-8a88-84a696346306", "value": 306496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699535067, "uuid": "d384de2d-0b4f-4c34-8da3-6a6c0fce9678", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699535067, "uuid": "3c9874c2-7865-4db3-9a4f-fe2e12c0a497", "value": "Vessels details.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e20763c2-7f47-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699565720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699565720, "uuid": "2e2dee16-99f1-4089-b76d-7f975d182299", "comment": "Malware payload (RedLineStealer)", "value": "8210c61dc906154922ffffda017e67cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699565720, "uuid": "3d9b6cfe-187a-407c-9e04-8dcd09eb9dff", "comment": "Malware payload (RedLineStealer)", "value": "6d8d1cf3edb69a33ccf6231a554be1936787f3fb150064504db94fcf46c58914", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699565720, "uuid": "b2b481c2-7f78-495a-aa36-ba85c90d7abe", "comment": "Malware payload (RedLineStealer)", "value": "9b554c77bd8aedd700bea47fcf9debe2069942a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699565720, "uuid": "e7706e26-f78f-4d4f-b5c9-78a4077d47fd", "comment": "Malware payload (RedLineStealer)", "value": "bbd39b15fba2eed3f96924b952f93ad08417452df4b26296964501fb994febf2d3578bd86e6bcb2313c2ecae1de72dc0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699565720, "uuid": "12bb13a5-b3f8-4f06-a6c4-67d6ecbdec6b", "value": "T164F639C7F89050E5C1AEE33485665262AA717C895F302BD32B50FFB82E32BD85E79354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699565720, "uuid": "4f999468-2908-4b45-ab63-2084fa50de4e", "value": "85cddd6092e65c1a58dd1e6e9ab9fc63", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699565720, "uuid": "4f3263c3-04a4-405f-a112-c37eebac3c3a", "value": "49152:1Dtq/9jRIrb/T0vO90d7HjmAFd4A64nsfJbL55kEUHsMd9dmJ7LbyHfwurZ23YRg:MR0TUHjsGg3wlVEgB1ACKu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699565720, "uuid": "27bfae88-2a88-4e97-8699-e44a2c1be758", "value": 15754241, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699565720, "uuid": "c188bd80-e7d0-49e7-968f-10d8d4b3bb2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699565720, "uuid": "257ce3b4-ea11-4c3a-86bd-e9de6414c008", "value": "6d8d1cf3edb69a33ccf6231a554be1936787f3fb15006.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ff19351-7f19-11ee-8907-42010a9c0042", "comment": "Malware payload (DarkGate)", "timestamp": 1699545852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699545852, "uuid": "ddf26e5e-e18d-423f-89f4-2fc2cbe3a5e1", "comment": "Malware payload (DarkGate)", "value": "fbf5d7b4c5f0e86a95b4fcd5c5ccc534", "object_relation": "md5", "Tag": [ { "name": "botnet-PLEX", "colour": "#3CFE1A", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699545852, "uuid": "944021e2-e7e2-4843-8700-38d8d7579fc3", "comment": "Malware payload (DarkGate)", "value": "6da198925581418863170f05b832cd1584b923278d0730d779a30ec96513111d", "object_relation": "sha256", "Tag": [ { "name": "botnet-PLEX", "colour": "#3CFE1A", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699545852, "uuid": "d72f7435-0dae-4a4d-a537-d5043e812c19", "comment": "Malware payload (DarkGate)", "value": "51588315ff4ae36412c337361ea65f84810938d8", "object_relation": "sha1", "Tag": [ { "name": "botnet-PLEX", "colour": "#3CFE1A", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699545852, "uuid": "60bbda4f-7276-43ed-b39c-220849c297b9", "comment": "Malware payload (DarkGate)", "value": "479412d57760034bb6fc2a8d9d9f3609be53cc75b678643a110554e2ea227301aaedc08ebc9ef0fdee4fe65e74dc28a5", "object_relation": "sha3-384", "Tag": [ { "name": "botnet-PLEX", "colour": "#3CFE1A", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699545852, "uuid": "ec47fa29-0788-491d-a086-8131cf67a4f9", "value": "T1F4963361728AC639D18B173AC156EAA13714BF545B70D1CB2B987C2C2630BF29F75B83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699545852, "uuid": "1f68a719-6251-4864-8976-f3e4aa5107bf", "value": "196608:0eS5hV9/S6WXbfXlTrn7HZ5AQX3AveLukj1w9OtaQCK0Ex7FVJi0:0dhVs6WXjX9HZ5AQX32WDb0ExZV8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699545852, "uuid": "55af49c5-7a33-43a8-a310-263480d4b563", "value": 8941568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699545852, "uuid": "9df5a31b-bdda-4efd-a98d-0c02f9151a48", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699545852, "uuid": "0fe5b96a-9319-4b46-947d-7f54f7598908", "value": "1c532f2594.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f72c52eb-7ef1-11ee-8907-42010a9c0042", "comment": "Malware payload (DCRat)", "timestamp": 1699528819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528819, "uuid": "17178536-c69b-4906-bd2f-bcd23974d379", "comment": "Malware payload (DCRat)", "value": "a80888af81d4191ed488547898c47358", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528819, "uuid": "a33c8d67-fe04-4bf7-a678-429596de0e66", "comment": "Malware payload (DCRat)", "value": "6dc622496a6c88dd974b3ed67940b5affb06e05814fc555f9f41d569cbddb80f", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528819, "uuid": "2da9994d-81d7-4bf1-99fc-af2d9a35c90e", "comment": "Malware payload (DCRat)", "value": "7377fb8984474f7e9613722bb16f2d1c79a26022", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528819, "uuid": "fc67e3f2-dde2-417f-a53e-acc324f40d27", "comment": "Malware payload (DCRat)", "value": "1db76fb26f4eca2b0ce7e0904ca2180bc637a21652b9d34ae0ce632c98ae6a3111c8103ed71d212940767e544b2c4c7c", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528819, "uuid": "124238a2-1a34-49b8-bca0-349d0ba8af64", "value": "T1F77533EB5F760C2CF60E29B971B58204B6B8580E66F1CB16321157AB05BBCF1247C96F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528819, "uuid": "54d3c362-16db-483d-a089-51c9fee65c64", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528819, "uuid": "ee275449-375a-45d0-9386-3457b5474543", "value": "24576:q5uOGH30yZmkO9HFHsMRSNPK0mPxaVbhjX5G1ybbIeW3DbYfTFDbKVOZiHLD4Ki1:vOfyZmPXaPexaNTG0fIembYbFSEZ8IOa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699528819, "uuid": "9593af8a-2a45-4801-97be-ce495f254f6d", "value": 1558528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699528819, "uuid": "4a88f0b3-4f4e-40e3-b645-fc24b9cc0774", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528819, "uuid": "e53d7d12-7b5c-46d6-88d7-11587058e5d2", "value": "a80888af81d4191ed488547898c47358.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1107a5bb-7ece-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699513400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513400, "uuid": "fa3e6890-0177-491c-ad17-8a8b62c51893", "comment": "Malware payload (AgentTesla)", "value": "d139658bbbb76c99466cd30cda6356b2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513400, "uuid": "e716a798-e793-4770-ae62-31aa85c243e5", "comment": "Malware payload (AgentTesla)", "value": "6dd0641e34c185dbb6e469a57111dde36b5f38872e33bb0a96f5140f19116532", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513400, "uuid": "63ed01c2-5f49-4e33-9218-c77a339e7534", "comment": "Malware payload (AgentTesla)", "value": "188a415e95637abb6aa518cc60843160e95d5cd2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513400, "uuid": "6bd09e7e-badb-47ba-a747-eaf2e8acba60", "comment": "Malware payload (AgentTesla)", "value": "77ffe39adc7c9c4c9f1e8ee6c7854fcdd2a3cce1e9fdbdf402c9581289954926aef1d0f428c33fde4102e55b34a50e04", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513400, "uuid": "4fc7c297-4c57-4f43-b562-ce3d421b5259", "value": "T1B5058C867A758172DE44C735C5E2491087A7EE5567E2D60974AE32EC0B373BE8F03A83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513400, "uuid": "6625b700-6e50-4b0b-99ae-1e17dc065dda", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513400, "uuid": "d5473713-296c-4d77-be0d-149db8ad6ca8", "value": "12288:aDIg1/h+nPWq8jwjLKUiw+YqQhtXHroNSoh:aDnwnPWtsHKUiw+Yqqt3ENSg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699513400, "uuid": "d5bd5104-1f99-4ce5-af43-dcd97fcb16ba", "value": 854288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699513400, "uuid": "3b2fa1e3-7f1e-4d54-ba72-104abafbc638", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513400, "uuid": "603fc3c9-e7ff-4a65-be71-39ea773005e3", "value": "Payment Slip (SWIFT)\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d580a6d4-7ef0-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699528333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528333, "uuid": "fe9c56dd-ecd4-436b-88d2-3bdfcf849c4d", "comment": "Malware payload (AgentTesla)", "value": "0a55fe291d358a5a0bbafbbf9cbffd8a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528333, "uuid": "7ccb00a6-0379-40db-af4a-e2d988eac204", "comment": "Malware payload (AgentTesla)", "value": "6f6bdf29657cf92d24ba2c3ed3e628eb3610b9bb9f271f584b1d2f01e40b4e9d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528333, "uuid": "c58ef4df-2764-4baa-9bae-6bdce6d33a51", "comment": "Malware payload (AgentTesla)", "value": "db99cb992b02ab959eb23c726351713b264a99c7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528333, "uuid": "21904c83-02ad-42ad-9918-ae5c0d80e390", "comment": "Malware payload (AgentTesla)", "value": "a435cd9c5d146d9893299ffaf9f7173db7562a1dae529b653bb577a7373e26fa8929544410d6042077370a2a4c97cf60", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528333, "uuid": "5709712c-736e-4eff-8ae8-bea3acf2092a", "value": "T1E3E40241366C9B57FA39A7F33170BB10033AF7AFA922E2099CD651D95676F004E92723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528333, "uuid": "5734c44c-bcfa-4368-8ffe-9fd476873202", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528333, "uuid": "4a805ea7-3670-4b9a-be9c-85261270c20d", "value": "12288:equVVcjl5vS5EzITAUDWxzHMlQ3tIbMJWF0ICevih9x8AqIc:xuV+XvShc6uzHywH+UhD8Ad", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699528333, "uuid": "c69768b5-eacc-442f-b6da-4b7be721431a", "value": 691200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699528333, "uuid": "f7ce16b5-01c9-447f-b6e3-971f54bf3b15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528333, "uuid": "b0e138be-ebcf-4367-8744-f78d6ba90cf3", "value": "PO_6213-00113.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff707920-7ecc-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699512941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512941, "uuid": "3dfa3c10-6d80-4442-9843-4629b88b3f15", "comment": "Malware payload", "value": "73a71d2ca9c8f3612dd0ee8dbf9a2fd6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512941, "uuid": "1da86957-cb50-4070-ac6f-f8d2e6c16ed0", "comment": "Malware payload", "value": "6fd6b5e4b0adfb00bd436ad0916b5d4ff6178aa78e28d22c81b6fcd159f19236", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512941, "uuid": "d0766e36-2ad5-4787-845d-cfde39227697", "comment": "Malware payload", "value": "ea7ff2bbc854075a3e6a3febed71f4b3b154be17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512941, "uuid": "14dcbdf3-993b-4b35-9e65-9e96a47b8d8c", "comment": "Malware payload", "value": "be2d96ca8d301fe32cf75678f17c7f5d0d8a9810463a5d68fd9c9b97c12a5e582a0bd82484d2885ba00081a3cdca7509", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512941, "uuid": "0e11575b-f5da-4fb7-a309-205dd3a5de0f", "value": "T13E334B0C338CAA22C67C2ABD8CF2164447BEA1F77D02E7079D84739569437E65616A8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512941, "uuid": "829c545e-dc8e-42de-9f64-d96656ac8f2a", "value": "1536:c6fuefdzXv1iJdq6ma/O0b9hk9vYEW5MB1vvzK:c6fum1irjHb9hFEWSB1XzK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699512941, "uuid": "ac1f6938-d41f-41cf-afc4-0ef9885eb720", "value": 54272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699512941, "uuid": "04de8cc2-f5c0-49db-bb98-8ba57be85f7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512941, "uuid": "d38972ea-163e-476f-b94f-a080906b8b14", "value": "PLS ORDER 20231106- C0X5TTA1J.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3356e88-7ef0-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699528329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528329, "uuid": "38bfca1c-1058-4d78-b735-715e6b106972", "comment": "Malware payload (AgentTesla)", "value": "b030d6861c81ec4daac22ef2f2c3028d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528329, "uuid": "e36d6292-453c-478c-84b9-f1a9161162e6", "comment": "Malware payload (AgentTesla)", "value": "71c9c1f938e1224224e9af62000618eff3d3aff874ab24f0db721cf8d70d2a53", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528329, "uuid": "f926cbcf-7602-4ee4-b11f-ec5cff5c1599", "comment": "Malware payload (AgentTesla)", "value": "84e657ad1f211338087688d9cd63bea2242be62b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528329, "uuid": "cfa18f5d-a291-47d6-b58b-9a73b6c7f901", "comment": "Malware payload (AgentTesla)", "value": "9fa5cf99dfc4629a09adc2abe51d85c2f67471729e2baca482df076d936d7c78e90fc705393fb180f9a4ed86f4b67f68", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528329, "uuid": "8374dd12-d103-4c68-839e-f7b691c93adf", "value": "T181848D063388CF21C51F15B6C8A3C2F81327BE00DD459BD776C9FF2A79B22AA6951587", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528329, "uuid": "5895797a-2efd-4904-a83d-32ce73281b98", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528329, "uuid": "6c84c345-c31b-4e11-bf32-bb7677c66997", "value": "384:RJZKyQUxX8GmHEKLdXn06CjFN8P3YsU6fCWYA8S/hs/E8sofOh/Q0RbnqyGt/QzY:LAyNILdXdM8sScz9Apqn+Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699528329, "uuid": "f128858c-01e5-44d1-89c3-e06f19a8b95f", "value": 379904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699528329, "uuid": "e1fb0c0c-e6c9-4982-a777-359695f8eb8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528329, "uuid": "69c636aa-bf4f-4b64-a62b-19a40e2f9e2d", "value": "ORDER LIST_NOVQTRFA00541\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "521520f0-7f55-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1699571492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699571492, "uuid": "8e3c2098-b9a9-44fc-a40c-d0d32d2c2960", "comment": "Malware payload (Mirai)", "value": "d93c12a53c683d37305639e80c3b7354", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699571492, "uuid": "37d06d8d-6f7d-4571-add2-2f4ce2dc19f6", "comment": "Malware payload (Mirai)", "value": "7266ffeefccf26e3d61cf36e5fbffc2c928f406bfa5123cbe43b2aa00ef1b262", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699571492, "uuid": "bbc113bc-607b-4bd0-b954-413b746527f0", "comment": "Malware payload (Mirai)", "value": "c43ac2b54b96baa18cf562ea1d22aa28b7b03bc6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699571492, "uuid": "169e5545-f406-4b6a-9be8-60d6ad60496e", "comment": "Malware payload (Mirai)", "value": "7bb9476b5c96674ab57c127c2383256bb1fddc86881e047ca78cd5c28a626433201455613d6bcf3a1e7e058e16e861fe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699571492, "uuid": "5fe0ff17-fd59-49db-afc9-dedd89a4d36d", "value": "T1E293A41A7E268FBCF79D863507B78E22965837C62BF1C141E19CDA015EB024E641FF98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699571492, "uuid": "2c94e14a-d9bb-439c-9676-7f9cc3156e46", "value": "1536:gKzqmzfphPukFhyx2XgHw/eFLdHDDh1PHZ7LUY2QPMj:gKqYhueXWw/eFZHR1PHZ7LUzIQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699571492, "uuid": "fc3c96b0-4de0-4d1c-bf71-2a8a0796ea1b", "value": 93472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699571492, "uuid": "77b87068-0433-46c5-8c80-fb03b0c4d1f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699571492, "uuid": "9f9fdea8-15b4-4d9c-9399-1d5983019f29", "value": "d93c12a53c683d37305639e80c3b7354", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "244eb53a-7ed0-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699514292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699514292, "uuid": "c883ed83-00ef-4970-b1e9-6e6fcab2c5f4", "comment": "Malware payload (AgentTesla)", "value": "cbd2ce5c821e62e67b8248e600375d53", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699514292, "uuid": "de82e2f2-c3b0-4e88-937d-48d642a9b6a0", "comment": "Malware payload (AgentTesla)", "value": "72e967aa15bae1e4b38fded2c8ad8201cb4230324d98a6ba3afe8c204d645bf7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699514292, "uuid": "9a93b7b3-1926-4db8-9f21-8f07e9d4098f", "comment": "Malware payload (AgentTesla)", "value": "b6b07456a460c74c296a75aff5aa3d97e9a6483c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699514292, "uuid": "12fb882a-7cae-440e-bfac-58032825b27b", "comment": "Malware payload (AgentTesla)", "value": "fb2cfb31a895252805a94b7bca3aad13558c6decdb21db6da0041de8f1d45ab9ff9232c20bb5bc425553de750238c1ed", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699514292, "uuid": "23e69c24-08b8-44c8-b0e4-ba232ec7639f", "value": "T1F51370E8F6E0558BC7D75A000B5F7D305098835D109B8297EA26DB3E2A707EDB854BF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699514292, "uuid": "21e07c2e-99bc-419f-b706-3dc46fdab432", "value": "192:pdEQBK4Obrrdgze5TZSmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmY:p2QBK4Ozee5TAM9Mo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699514292, "uuid": "48143b58-3b61-46fc-9ef3-64275b57b161", "value": 43258, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699514292, "uuid": "35a13ca2-862c-405a-ae10-ec8b44ae56b6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699514292, "uuid": "23f33cc0-485c-4333-9932-66c8ed877e9c", "value": "Drawing.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e553bb82-7f51-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699570021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699570021, "uuid": "5fca0959-89e3-4372-b12e-c9d2c3112086", "comment": "Malware payload (RedLineStealer)", "value": "b2d158df42c51113e4e6db28a7e833d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699570021, "uuid": "ab1f37f8-2e44-44b2-81b0-eeb27b0f8ba1", "comment": "Malware payload (RedLineStealer)", "value": "731272360545369bceef32deea39cc024304aecf431d1693ef1b2bf90555a434", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699570021, "uuid": "af5d0298-9d00-4190-955e-fa3604dc5366", "comment": "Malware payload (RedLineStealer)", "value": "66d78ce0608a47f6635b4a4eb48d09f07cb528a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699570021, "uuid": "a8191372-890c-49b9-b4b9-9396235d5692", "comment": "Malware payload (RedLineStealer)", "value": "fdbfcc669986353b0bbd4c56c7f9f148b1a1a3a74a4a75849950b998102c45e4ff8245d7e439eef2af138ec94e9f537b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699570021, "uuid": "aab1b934-206c-4b52-bad4-f94290afb70f", "value": "T161B41212E6DC5072EDB407B06DFA16D30E367CA0A974936B2785984F0C739D4AA7633B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699570021, "uuid": "21f9d5bf-eb0e-4030-b5a3-5ef0b560967f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699570021, "uuid": "a51c482d-3eef-4c9f-a0e2-81e83d469d07", "value": "12288:/Mrzy906lnoIEcPi1DrLc+wcWMiUUY8TUs2euF+4+wSRWFAjormb92:gyDbPyvweWxPYSz2eu4USMc92", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699570021, "uuid": "c695d7d7-d80a-4843-a4f8-1029ad0b7c74", "value": 523264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699570021, "uuid": "1d348e69-b685-4bee-bcad-d0f339e009f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699570021, "uuid": "244ba74b-0a42-4fa9-a9f4-b2bf8376a11c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "149f4e25-7f02-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699535740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699535740, "uuid": "1112d8f5-8410-44d5-8fe8-857bac0c9bad", "comment": "Malware payload", "value": "b58e06fc0ef74abfd5ede1e44aa8de4c", "object_relation": "md5", "Tag": [ { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699535740, "uuid": "3a6ae9d2-dff2-45e7-ad70-fd0ce5de9214", "comment": "Malware payload", "value": "7387d00194adf8a8f15e12e191bfaa8dbd6c7af227ddc14d7fec742b30adc245", "object_relation": "sha256", "Tag": [ { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699535740, "uuid": "b8786e95-45e8-4524-927f-d28b0cf1e015", "comment": "Malware payload", "value": "bfd742b86fba3dc75a540ec34ca1166f268ed251", "object_relation": "sha1", "Tag": [ { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699535740, "uuid": "c4a9c9f7-9560-4e65-b151-c14d39632418", "comment": "Malware payload", "value": "6c110378095330269e93fe7058bfed55cc4ca28762666d7a30f58d1a4468af48fa0e3c3a5a4924473ad37e9985e9e4b6", "object_relation": "sha3-384", "Tag": [ { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699535740, "uuid": "5e43550f-a5f6-4444-b031-254ef171d253", "value": "T1BE9733282577E2C2CF099476A1D1E6C5842B60C591B8393AB68FF99C7F3366D0E5B34C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699535740, "uuid": "0516b385-0a1e-4e1c-8a6b-43495db92480", "value": "96:PxESxEAqXvc40wg/62UeZKw9Avx3ie0LBARCqF+Nf1ZMD+aqr622liHkoTcOqh:PeSe1kDF/rVZKSmUIVIDyBOXkLOa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699535740, "uuid": "42bc1ba8-799b-4a2b-bb8a-0c71e2798d35", "value": 43260547, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699535740, "uuid": "fb00d71c-308e-436a-b204-d41eb07dbd91", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699535740, "uuid": "117ac252-eb54-46d8-a2a3-3f324de40496", "value": "2023.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb3cdf5f-7efb-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699533040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699533040, "uuid": "f3ad0eb8-51d2-4aae-b9d7-312b06aa81f0", "comment": "Malware payload (AgentTesla)", "value": "53d1a45da6d54d29244973f8ebcabade", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699533040, "uuid": "65092441-24be-464e-841a-74ce165103d9", "comment": "Malware payload (AgentTesla)", "value": "73e4461c11220285693d2cb08a17b0fa8a605415bb5982eb8c303b4d03a9406f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699533040, "uuid": "f17a4502-f3a8-41e5-a7d1-7947fddfd15f", "comment": "Malware payload (AgentTesla)", "value": "d45109d3efde7261921b7993528225aeac9bed00", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699533040, "uuid": "afdbe5b9-5983-4733-b9a6-3aea14f111d9", "comment": "Malware payload (AgentTesla)", "value": "dfe896257240e172462a29b4a28d1de73c787446f991bb4bcdcbcb4b878a8923d38add78173840cfdd3427604d301ce4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699533040, "uuid": "ec2403cf-6f8f-4ade-b35f-67b8b678d46e", "value": "T1A6E47B3D5AAC263BC2B9DFA58FC1C527F1D499A77051AD74A8D303A64342E56F8C023E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699533040, "uuid": "11cd9fa6-f76a-48af-acf5-d345b7338523", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699533040, "uuid": "589992d4-626d-495f-ba22-0236829a4813", "value": "12288:lnlbRBeyAf64P6M8O0vYyROZq/g2YX8BX1Rllm:lnlF4xf6m6lO0vYy4ig2xX1Rllm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699533040, "uuid": "3c51a253-2034-4cb7-9526-816390ea1abd", "value": 699904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699533040, "uuid": "36ca5c59-5e9a-4066-8df9-9a72ade0379f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699533040, "uuid": "3510b544-31bf-4743-9049-4a8d083d7132", "value": "SecuriteInfo.com.Trojan.Inject4.59820.21808.30129", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55d746a7-7f55-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1699571498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699571498, "uuid": "dd085059-d0bd-4e26-8933-9b5fabed5f55", "comment": "Malware payload (Mirai)", "value": "09b0cef0ddc18549a8039c7691b3e683", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699571498, "uuid": "04b473d4-fd57-4620-b64f-e50af6071509", "comment": "Malware payload (Mirai)", "value": "744d441987e7e4fbe5f4efaa03d746c4a919055347cb3210a36dc57b3185694e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699571498, "uuid": "8651e981-7c8f-4047-b518-fe68ec935616", "comment": "Malware payload (Mirai)", "value": "b6785f196d5d71f1e83767d5235cadfe57f4c866", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699571498, "uuid": "e63b9467-fc0a-4572-915e-59472a993ddf", "comment": "Malware payload (Mirai)", "value": "2c126c50d132ea141e3ef479256c683c47374eb5e48c2637f539d02492843fc4725ec900a9ee658e1b8d89e2b58b26e1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699571498, "uuid": "409f8574-0eb6-4281-a942-88c508e8cac5", "value": "T159732996B8929A22C6D4137BFA6E41CD372163E8D2DF3207AD201F647BC681F0D67E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699571498, "uuid": "fc376136-8862-427a-ba67-c6ca01f69673", "value": "1536:/pXcKpBUlet3DBboJubLCNQpRTdafkcahWMPM4Y4g5q9/e35HsFr:/pXcKLU1cR8fkvhTEqgp3eF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699571498, "uuid": "25abce82-6769-4241-89f8-9af9317e38ad", "value": 74744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699571498, "uuid": "e464ef8a-c1d4-4ae2-a212-b50c30f79547", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699571498, "uuid": "cea6f8e4-f793-43ff-bf58-4e9174ef8860", "value": "09b0cef0ddc18549a8039c7691b3e683", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb940f5e-7ef0-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699528316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528316, "uuid": "0e6c5b85-2cb0-453f-a024-843b8f85db97", "comment": "Malware payload (AgentTesla)", "value": "27ee6f94451763acb15c427adfddba5f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528316, "uuid": "af399135-158f-4ca9-aca7-be38ef6588bf", "comment": "Malware payload (AgentTesla)", "value": "755796e62c9c0c2f5c5b664838d93083cd1c3290ba666dd84bb497b38a953776", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528316, "uuid": "84c39695-b6c8-48ba-8cee-747ed450e970", "comment": "Malware payload (AgentTesla)", "value": "1c3e2c1148afe19681e50aa0a5ed027581b432e5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528316, "uuid": "b74bbd8d-7a21-4369-8650-1614e2a667e6", "comment": "Malware payload (AgentTesla)", "value": "b0ffa2e1aacd634aa318b769cc609ac250cfe44d7b708898d7c949b33fc3e7a17263646a11fe5f37481af09d8fdc25bf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528316, "uuid": "d193b114-32a4-40cc-828c-8277e2b18c3e", "value": "T10CF3396992CA8D11DF3D40B8C9B111080BB2E177925BE75D0DB1ACFA3D5A7C33E2E865", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528316, "uuid": "d2240cb7-4aa6-4fbd-8e72-8411651a9fa2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528316, "uuid": "12fcfb27-f2c4-4632-807d-b4604b7853ba", "value": "3072:yzzgTraQs62o1xGqhUkNc/VSgTq6VCLIXMYkMlXSv:yg37sQ1xGqhUd3bVvXEMl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699528316, "uuid": "8bb3d7d6-a0cc-4015-8c5a-6e7aa0242a5a", "value": 168448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699528316, "uuid": "f1a49842-01d0-43c2-93b7-b38f76fe55a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528316, "uuid": "4901b69a-6714-4ac2-9368-c563c71e7e9a", "value": "755796e62c9c0c2f5c5b664838d93083cd1c3290ba666dd84bb497b38a953776", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21630255-7f25-11ee-8907-42010a9c0042", "comment": "Malware payload (StrelaStealer)", "timestamp": 1699550794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699550794, "uuid": "2dba5788-7d2f-4c1e-8add-0c407d71f620", "comment": "Malware payload (StrelaStealer)", "value": "5fc03cebba29eba89aa74e5c8462abc2", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699550794, "uuid": "f56e4f0c-f08f-4cf8-98a6-59655a335a5f", "comment": "Malware payload (StrelaStealer)", "value": "7693aae819937d6b3d4a8427a16dedc38c0caf0a3988a284c5d1dd7b269eb60d", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699550794, "uuid": "feae74cc-0e4f-44c9-8edf-bc6313ffbcde", "comment": "Malware payload (StrelaStealer)", "value": "9a28fd10f31667908d4b109de68612a93ed9317c", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699550794, "uuid": "74f21fd4-ce02-44fc-b9aa-34342f8afade", "comment": "Malware payload (StrelaStealer)", "value": "c4d2c10c8a853181b86744227552a2fc96b5b1502040bad3820847c1377339c3a1ecf00194a328f0872f75242529d973", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699550794, "uuid": "8525134f-e0ef-4879-a729-9da5328c78f1", "value": "T12E9533A08EA95C2E0BAC9A18615F4F5E25E1E7B4C005E7CB6CF161C7214F3D2E49F46E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699550794, "uuid": "ba9ce798-fd4e-4c39-a5c2-6aea7d3626cc", "value": "24576:8WJnA1wrb+wgS37HC/1zQLHN38n+IomF0X2VkJypu4XnJXUkBh0vM9R0yRHbn0M9:8MfYSrQzQZtuHlXWyhZ9RFQWuOe2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699550794, "uuid": "8c821aa0-f294-4246-9578-6985420815db", "value": 1913007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699550794, "uuid": "d8a33a73-1df2-4ba9-82ef-aef9f996d679", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699550794, "uuid": "6e4b41de-9c59-43dc-bcd1-63def1bc7b76", "value": "Qtagiietkyb.png.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bae9234d-7f28-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699552340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699552340, "uuid": "034394fe-8903-4aca-b1e6-4ad162f8ee5c", "comment": "Malware payload", "value": "dbc07315c0eb47b067a5abf6deec6ddd", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699552340, "uuid": "2596bd4d-ffe5-413c-bbc9-a5cc0c608e2c", "comment": "Malware payload", "value": "76eee4eb67cc1ecf8bb73959201d22a243e82f259eea0d736822327d95fed3d3", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699552340, "uuid": "b4103de4-373b-42f7-bd85-50c1ef3395e2", "comment": "Malware payload", "value": "e837e110f1a762fce0d28c249f357b16fb17e3d1", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699552340, "uuid": "beffa730-b7fe-4285-b79b-e6b50cb6a3dc", "comment": "Malware payload", "value": "fb06fe3b3c1dae3f70be050cf105ce8b7f7d27645fd87fd03247260d473f23c7e579ab5655f85416250319d0b49e0f34", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699552340, "uuid": "2a94255f-9ddb-4cac-9a1e-808d8287ec45", "value": "T148630D02FE656B21C0925A7855A6CBA14323FE96CBF093C271DF3A2AFB770305A43355", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699552340, "uuid": "10028864-5aef-439e-9fec-31dfe18e00f2", "value": "384:bZ46uvdXvlDA2EpqzGvKhIhnksssssssssssssssssQsiSv7I3fyt91bhd4HDTj/:146uvlvlDA24gGGoI2HbWHjYD7oz99", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699552340, "uuid": "39b8c11f-5ded-4001-bf0e-72b4162ea081", "value": 67072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699552340, "uuid": "b1b5aab5-f22b-407a-a75f-86c7b67cd6f8", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699552340, "uuid": "37786cff-f7b9-489d-835d-df539bba0c42", "value": "dbc07315c0eb47b067a5abf6deec6ddd.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d83a35a9-7ef0-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1699528338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528338, "uuid": "322daaf4-147e-4e91-a6bd-848ea4884986", "comment": "Malware payload (GuLoader)", "value": "75648cadda61b59c9c19ad73e2cbc5d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528338, "uuid": "7470699f-6d17-4b02-9226-0c5118b2e300", "comment": "Malware payload (GuLoader)", "value": "789c11195d744ba700a08033136d77d9385fadafb51cbde330902a0442225bdf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528338, "uuid": "c3616b8d-ffb2-47b4-a841-ff4ea02fc51d", "comment": "Malware payload (GuLoader)", "value": "04b5dc7a25b3e07dd44f7de41042d909ae119191", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528338, "uuid": "46b6f299-f32b-4e9d-b3dd-c757a7b56bdc", "comment": "Malware payload (GuLoader)", "value": "7bd4a5e55da067c7809be09c10809bd5a98dd323f47dbe58a8ef234f3fe050ce7c4670f392944118a53668ed1c989566", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528338, "uuid": "53855e93-372c-4d76-95e1-3e013455042a", "value": "T1BEF402C0D5904192FC6A0F7664335D3A5AA73E3DADF45A8E0A5C76653FB32C3403A91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528338, "uuid": "0e69a36d-d172-447d-8208-645b51d2898f", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528338, "uuid": "ea0858bf-d47e-467c-bcca-3d39b0a4b6e0", "value": "12288:4ThPiFGYnsDnfhWbcpoOR71sJL5ydokhTg04XOp/LMTgF9FigDkkcWncOQsq3KpY:4ThPiFGeYEQHR7WdFep/wTY9Fdwk5rHA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699528338, "uuid": "4a78e4c3-12de-4ea3-a14b-b1818502dfce", "value": 761926, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699528338, "uuid": "5c9b608f-3880-4463-9274-b9da32b1344d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528338, "uuid": "1ad096b7-bcf5-4b0f-9bc2-a168b02800c5", "value": "Scan_Quotation_Order_Requet.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05401c12-7f3f-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1699561914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699561914, "uuid": "7003add8-85ad-49a6-b439-78c29ac1db53", "comment": "Malware payload (Stealc)", "value": "d2a1f2c5cd143b903ddfc2e1c8914a70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699561914, "uuid": "e77c4358-0361-484f-aa2a-fc20edcf1232", "comment": "Malware payload (Stealc)", "value": "79ef63134bbac744a99bbd837dd2cd09e80652204daf7c4af120d12b33b9b04e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699561914, "uuid": "74121cb6-df12-42fc-8035-dfde6b139a09", "comment": "Malware payload (Stealc)", "value": "b3a39c00ea07672daf35661da1be6f7f3cec69b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699561914, "uuid": "e88f16d3-4bb1-4737-b86e-9a684a38d25d", "comment": "Malware payload (Stealc)", "value": "d9a10b8bd4cbddbe905ab3655dbe9cb97ca6bd437f7b15d5d55dfc8d1be8edb7c3bd4590ba2016f934a5c3d5ee65f648", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699561914, "uuid": "8d83a97e-d7c1-49b8-9653-d28464304c97", "value": "T1E9445C13D2E26C6AE6274E318E7AC6F86A1EF9614F543A9A12F4EA3F05701F1D173701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699561914, "uuid": "32dd70fb-8753-45ac-b7b1-c734a40adadb", "value": "1995abb18e299139f1d340ef101da292", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699561914, "uuid": "4d4a59b4-f006-42fd-8d2e-f5e16dd2689c", "value": "3072:Ojok1BWQVhEcjoK5MRVSken1B6GmNpJIIR/YT6JeSOyn:w1BWQ33oKGL7Y1BdmNz3A/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699561914, "uuid": "5efbcb74-8da2-4560-ad5b-0f1c1706a4da", "value": 267264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699561914, "uuid": "5d50f8ca-cccd-47ee-a979-f7e28cfb3130", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699561914, "uuid": "e3d86af9-d24a-4b02-ad6b-b9006ad3ccda", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a70c9b4b-7e9a-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1699491318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699491318, "uuid": "b7ff0cdc-a3a2-4210-a3b8-b95efa5c2e95", "comment": "Malware payload (Stealc)", "value": "f171e0cbf50017c78c57fb407f5fa2d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699491318, "uuid": "e26f75fb-e09e-46e8-897c-7c26dd1b88d1", "comment": "Malware payload (Stealc)", "value": "7a5db7f07be7cf42aad1be683e2c591c9ba7c7a8ecd9c791cba24a7da4abd6b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699491318, "uuid": "c54cf55d-e3be-41b4-bec3-ed9d9c6227e5", "comment": "Malware payload (Stealc)", "value": "181d9a2040babf7d7132322fffe884c1a4355acc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699491318, "uuid": "b83c1cf7-16b6-4cb8-92ca-a909858faf2c", "comment": "Malware payload (Stealc)", "value": "d43c502af0cd9ccdd83c85cb71f5742b706490eb3e8c63c3bfa4636c17a36a74816dd7f637b780043b98c9ad7e23e3a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699491318, "uuid": "1fc10c68-71ef-4df0-ab96-2fa7ce22999b", "value": "T17364E84352E23C55EA26DB328E3EE6F8771DF9518F0BB7A61119AB1F04B11B3C1A2711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699491318, "uuid": "b7f699ee-8f34-4107-8187-a9c1121dd84e", "value": "b7e07a5800cbc9c6f303fe6cbe1b23f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699491318, "uuid": "76d8bdcc-9e73-42f5-a473-6f146d290be0", "value": "3072:63CndhJEy6xHqns72Z6fJgyTOC/hQIeyuFSHxdo8glu9sEkgcB9iAHsEz:dd7Eym0s72IfJgyqK4yuF8Murcf/H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699491318, "uuid": "cd76bd75-6852-4aaf-bcc8-5aef258e87f2", "value": 325632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699491318, "uuid": "29f4d4de-5969-4d5f-8e04-d777bee0a30d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699491318, "uuid": "d2867a9a-62bf-4221-a38c-2915c8ca9ba8", "value": "f171e0cbf50017c78c57fb407f5fa2d4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52dac035-7ecd-11ee-8907-42010a9c0042", "comment": "Malware payload (PureCrypter)", "timestamp": 1699513081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513081, "uuid": "90b84856-b136-493b-b40a-0a92b4884569", "comment": "Malware payload (PureCrypter)", "value": "8f64b9764c3c0d56b31887835fec77af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513081, "uuid": "c4e08d47-84c8-40a2-87f9-4385175b4401", "comment": "Malware payload (PureCrypter)", "value": "7a7148f2d8f7f73a1ea74c2064c0b401b6d13d7131c630ed8584ed45673554aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513081, "uuid": "fafe0420-8a01-4c37-8fec-42327d484178", "comment": "Malware payload (PureCrypter)", "value": "b91760ad2b24e44f70add7b739439f7b55b0b4e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513081, "uuid": "54b823ad-57a4-44aa-8210-5e58760d486d", "comment": "Malware payload (PureCrypter)", "value": "647f05cca4c282c0a4a89b82f04dcc5fe15333425a6ce65e9018dc84645d3d98ea4a9ba100f1cc8253f3cc25f24410dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513081, "uuid": "9163dfcd-fe5c-4975-8dd1-7bf01e9bd535", "value": "T1F6630A07B79EC6B0CA589B7AC6A77500C335E582FD53FA0E7D8E634A18037BA584174B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513081, "uuid": "b4e5bb6f-8685-4d2b-a0d7-f8e423327116", "value": "1536:ncZ2K2lGuU98J5JgV2j94GaN2VFhl3O6EvvT:8TJuU9+gG947qFEXT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699513081, "uuid": "17bf7779-fa65-43f9-8cb8-e68c50d010fb", "value": 69632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699513081, "uuid": "0150f80c-9e1a-446f-a176-220ee99d8320", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513081, "uuid": "48f5f077-2c43-46c7-89f7-d26e774deb30", "value": "Sample Design 1.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec32b9d7-7ecc-11ee-8907-42010a9c0042", "comment": "Malware payload (PureCrypter)", "timestamp": 1699512909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512909, "uuid": "4dd59cd1-4b99-45ac-ac07-d90add7d9077", "comment": "Malware payload (PureCrypter)", "value": "0612530291bb169abb0b116b517702bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512909, "uuid": "66f819d9-119f-42cc-b564-011d8e3ed7b2", "comment": "Malware payload (PureCrypter)", "value": "7ac41e8737d3e0d157acf48febba19ae0e3fa01ef33a919cf297ae06af75e344", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512909, "uuid": "3c4f0da3-54d0-490b-a41b-0a1ce0b7313a", "comment": "Malware payload (PureCrypter)", "value": "ceb3d917fc364e0728048c66d6657f9f5c39d22d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512909, "uuid": "27adeae5-cc03-4cee-849d-85acb542d710", "comment": "Malware payload (PureCrypter)", "value": "7f16eb426df166b241e3f79a934ef0eac7c04b3f3b8f614be8673cb3c957fc38176ef03700cf86ffb4f00337bcd0874f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512909, "uuid": "82b8624b-1662-4835-8e07-f6803280bf54", "value": "T151D20B46BD6D86B0DA27873DC8BB8D174374E9839613C90EBA8F234B5C133BA9519347", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512909, "uuid": "8db47894-4f9f-4295-9d6d-638a8b12bc4a", "value": "768:sdUIl8P5DDjShjAQX1RwbUU0SpSc18/9IOs3Q4AycyrsR2vZc:saqw4AkrmUU0SpSciFIOsg4XvvS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699512909, "uuid": "053fb6ce-db97-413f-921f-0b6c363d7edf", "value": 28672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699512909, "uuid": "c9454c6a-67c0-40a5-92a8-1f10f9299ea6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512909, "uuid": "60875146-9e83-45ec-8b38-9c870486bff3", "value": "Product Requirement 1.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c17290c4-7ecd-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699513267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513267, "uuid": "4924d955-0b25-4038-ba10-99ca7d16043c", "comment": "Malware payload (AgentTesla)", "value": "9411bfe9f7f2036bfcf4f48d990a7dfe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513267, "uuid": "2526c375-2374-41c2-aca0-f43f563ed7ed", "comment": "Malware payload (AgentTesla)", "value": "7cbd052cfacbd32d5d3f4d39f630d2e016e03311a61b16f568e242b26b91c211", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513267, "uuid": "b7c53109-6c69-4b61-9fa5-08890d3eaf98", "comment": "Malware payload (AgentTesla)", "value": "629efdb6dab2ca16ebff92de91dab16746c26e71", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513267, "uuid": "4186d559-de26-40f8-b93c-d8d054d86ba8", "comment": "Malware payload (AgentTesla)", "value": "290c54e7fc11eeeb0660ad8a2b71a4b9bf03a7a0ae5f4fd281d835f98c127fdeec6b6f99cb73f31309621ef2bbd19a60", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513267, "uuid": "352990e7-1f1d-4781-8ce1-1ddb9b0e82d4", "value": "T1C9057C0A76758272C944D775C6E6491083A7EE4A77E2D20A358DB7ED0B333BD9F03682", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513267, "uuid": "b4cacdb7-af76-4ded-a23e-7f5171368d92", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513267, "uuid": "e41f0d5c-ff75-46a6-9aed-bd45a8605e3c", "value": "6144:8WUPoPTfeBaAN07+O4xlO8ukH2ixqluomAF1UNEjdZAH3eQwKt/bo9dNvczIs9Hb:lKNe7+O4xUb1BluolL2cp9zv/+HCyVY4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699513267, "uuid": "614f3874-c004-4aba-9c2e-6bae56220228", "value": 843024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699513267, "uuid": "8e8fbbf5-75a5-4c5e-a65d-8d0c156b05fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513267, "uuid": "ee2fbd80-41a7-4a8f-bcd2-02efe1c36980", "value": "9411bfe9f7f2036bfcf4f48d990a7dfe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8243c398-7f00-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1699535065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699535065, "uuid": "789e893a-a55a-4cfb-8fbe-02d3288ff7d6", "comment": "Malware payload (SnakeKeylogger)", "value": "c6184a0858570ab06401a2d9a7abb84c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699535065, "uuid": "ff94ee5f-af8b-43e0-9b4a-aeb345b5fb01", "comment": "Malware payload (SnakeKeylogger)", "value": "7ed99eb3221d685130ac3695222e9025dd62e2880f3af360140ef1d0532e80e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699535065, "uuid": "cc0fcfa8-b519-41a2-b86b-d2992006e870", "comment": "Malware payload (SnakeKeylogger)", "value": "5db26522798afbc174087c44fa4a7c233b4eb9b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699535065, "uuid": "c04c98a7-1444-4286-8b30-0aff09d2b2a4", "comment": "Malware payload (SnakeKeylogger)", "value": "32695ae7ddb79b78e447f344d1bf3c346342c6d58ca2e6186a1512c45433ac7376017aa1dc884c14d2b93e127d675bcc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699535065, "uuid": "513d21de-bfa8-463c-965c-12817477e63b", "value": "T11384F10423FAAB0BF9B24BF465341161C3B2676B65A3DB6E4ED230CA05EAF544761F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699535065, "uuid": "2c25eb1a-1760-410b-931b-2a2cb7c3b3f8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699535065, "uuid": "563ff712-454a-4bb7-a9fb-40404937243e", "value": "6144:DN7zMdPae0pRMF3Ngd/hXQyKuJ9pcalfJZiiMPvhliJ4N+CvacHp6+7ojLQJzS7M:4aRcdMxpIiUHPw4Hp2jLOu7vJRQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699535065, "uuid": "07e52ffa-7f3f-41e3-b1d2-de3a98cc1796", "value": 383488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699535065, "uuid": "aa878322-47b4-4447-8e4e-3eef86695792", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699535065, "uuid": "702c077d-b02c-42f2-8eab-bf1b30906f8c", "value": "Vessels details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60934244-7ef8-11ee-8907-42010a9c0042", "comment": "Malware payload (MysticStealer)", "timestamp": 1699531573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699531573, "uuid": "46f99812-fe11-4438-b54f-a6fcadd50663", "comment": "Malware payload (MysticStealer)", "value": "517a5a7111c717d375f9d34fc269af6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699531573, "uuid": "b88f023d-3750-4b81-b0d5-98b862eff71d", "comment": "Malware payload (MysticStealer)", "value": "7fe04ecebbbe75b8af9f346ced8b175856b26797016c3574c202d25b81bdbd12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699531573, "uuid": "9e8579ec-8e4e-4ca5-b5fa-625c47a86341", "comment": "Malware payload (MysticStealer)", "value": "2a5fd048e0a505d394c2d9e2fc2fd29b5bfc6d21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699531573, "uuid": "93f5c1d0-f8f5-4529-bb6a-1ce1f73db578", "comment": "Malware payload (MysticStealer)", "value": "887c07c5b0dc81596d2fe59406f206f518a4071f45cd15e45a9010b049da4f61235661f53d964bba17729254ef9ef37a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699531573, "uuid": "05cdf3e8-d33c-4365-9429-15e8e6fabd95", "value": "T15C359E3178D04D71EDE620B752ECFAE6829D94B0071946CF429877EED76C6C1AF32682", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699531573, "uuid": "4d2952b5-ecef-436f-8f0c-27f9e50be51e", "value": "024577db1b2f78d9648d80f0a068dab4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699531573, "uuid": "362df7a6-9e97-4c1c-9cba-cb286624b761", "value": "12288:rJDm0NIy0xHm/3dm9aNlL5fpdhNbtQT9DX+ecruiTb5Gbl5VT+OQTw2:1Dm0NIDHm/Nm9aNlNBNbKZOL8HXK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699531573, "uuid": "3aace669-1662-4fbd-b331-36d89ca1ebd2", "value": 1121280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699531573, "uuid": "a01efb4a-7b92-4681-8424-48fe8359d7b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699531573, "uuid": "561d3c88-c4c5-4610-a28e-3551bb483652", "value": "7fe04ecebbbe75b8af9f346ced8b175856b26797016c3574c202d25b81bdbd12", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afb033d7-7f4a-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699566924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699566924, "uuid": "98b299aa-ecc2-46a5-aabf-93d0ac7a6a2a", "comment": "Malware payload (RedLineStealer)", "value": "22fa20f3f3a2343a50e6fc1f254222a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699566924, "uuid": "7b125d22-5419-403c-a940-3d7954c58095", "comment": "Malware payload (RedLineStealer)", "value": "800819d80a567e248884c25757bc3739af42f0dfed7ed78d4f20af7e0b9aa34b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699566924, "uuid": "340f3396-3b46-411f-a7a6-4572a7dab2b8", "comment": "Malware payload (RedLineStealer)", "value": "ad19a25e875d411622f8a14aac75dffcf3a167d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699566924, "uuid": "28891224-0b4f-4231-84c2-f0abc05eccab", "comment": "Malware payload (RedLineStealer)", "value": "3814f91c067123b45f0fbdd069ff8184528a20889f7466f7c0ae53fec821eeeff117629d449a1cb7b9b041fa6541a96d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699566924, "uuid": "f510d7f8-1da8-40ae-8364-b1f7796fecd1", "value": "T1E4B41266E6E98472DDB1277068F602D31F353DA1D578836B2345B81B0CB36C4A93A37B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699566924, "uuid": "997425b8-6fbe-4327-bef1-d60618a56468", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699566924, "uuid": "4d2db908-9ce9-45be-a827-427d084860f8", "value": "12288:sMrly9094KCbzlLYUwoY8TUs26uN+4+wSRPFjAUA9aoL:hyOFClLNtYSz26uQUStyUA/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699566924, "uuid": "b35959ba-830c-4410-8668-eb3aaab42959", "value": 523776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699566924, "uuid": "53834bb2-c7b5-43c5-9608-f4a9ad39c030", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699566924, "uuid": "2a106bc6-5139-4f0a-863d-690da1229b31", "value": "22fa20f3f3a2343a50e6fc1f254222a3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62d47a08-7ef4-11ee-8907-42010a9c0042", "comment": "Malware payload (Nivdort)", "timestamp": 1699529859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699529859, "uuid": "5b2e9929-7960-4e33-b8bd-e6b08ed07998", "comment": "Malware payload (Nivdort)", "value": "7afb34f53e22cd0663588b56bf636d36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nivdort", "colour": "#21A77E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699529859, "uuid": "9d80d401-6b3e-4886-b713-1a7f2627bf81", "comment": "Malware payload (Nivdort)", "value": "807cbfeae9f24ffd2ec162a18ddf4e9254041852fa9949743c4467abfe136de0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nivdort", "colour": "#21A77E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699529859, "uuid": "fb4f5879-70ac-420c-9a57-66dc817bad42", "comment": "Malware payload (Nivdort)", "value": "22d1209f9cf83e5d46ca413a268dc566146d7a8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nivdort", "colour": "#21A77E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699529859, "uuid": "0bd4d233-5776-43b5-8d21-4b59e46ba266", "comment": "Malware payload (Nivdort)", "value": "21e07806b9744cf8e38f704ab2bdd505c947108bfbb28269c33d4b1a3914b902be4ddedc35c306144885c53509182372", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nivdort", "colour": "#21A77E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699529859, "uuid": "124abd27-c58b-4919-9aba-59d6a94aeb0a", "value": "T155E43918B8D3946AD6A974310278E237196EA5700BB45BFE1F4409FE0BEE480EDF751E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699529859, "uuid": "0b3c8bd8-ae03-402b-9306-2597482daf21", "value": "903b927c91b2e17c7afc6ceadb7546ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699529859, "uuid": "41beda4b-bd43-4d9b-9364-29ca4c22f098", "value": "12288:U8MQitSAABQYNTCu0SmMn7mzvixedRppGtwSXH:UtSAAuYdCucGWSX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699529859, "uuid": "3e577354-93ce-4820-ad66-95ff9c10ee11", "value": 677888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699529859, "uuid": "8a2a0ff3-3042-497b-88b5-99616fa39678", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699529859, "uuid": "c956ef83-fe0b-48f4-bdb3-854a832cea49", "value": "807cbfeae9f24ffd2ec162a18ddf4e9254041852fa9949743c4467abfe136de0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06b0dedb-7f46-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699564923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699564923, "uuid": "3c8d9fe7-c563-4446-9bf7-811ee0eae4ec", "comment": "Malware payload", "value": "f8723b83c7601194bdd0ca00715d897f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699564923, "uuid": "7e1cd6d4-77d2-4723-b627-e9343dc63fa3", "comment": "Malware payload", "value": "8089c3199a3f31dbddb58b4fed86739dc18f34a1a462e340b9bad812e7e7d3ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699564923, "uuid": "827a5812-3b3a-4221-bf41-322ee66d4ef3", "comment": "Malware payload", "value": "b52ce26c178f442311a4779b7e208194c0f16f0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699564923, "uuid": "2568c571-4514-4f1a-9616-24f7c6c735bd", "comment": "Malware payload", "value": "a074e24a76ae5afc7d480033194308e600872128e30b8be8e9ad0d1d34c0d64e8e1d00484e3d1512c6fd5b3466aee80a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699564923, "uuid": "ab50f850-0ae6-4ea8-b41c-c871c4b25def", "value": "T183656B23D112C0A1D65826B01BF60B3EAA7857B50D359A87E3E0DDBD7F72671DA2B01C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699564923, "uuid": "0ace95e5-3978-4ef0-89e9-22e0884fbaa7", "value": "69fea2040c24bfd9308e7bec5d8cad23", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699564923, "uuid": "8a95f498-cf89-44cc-add9-4023411d8d1d", "value": "24576:h7IU4xjdSPu7kcmxuMBLbVdP4+nkWVvN4bZ8curAjgSuyAPNn:h7/t4+7hcuA0Suy2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699564923, "uuid": "981aec91-75c3-4874-bc84-0fe83c01754b", "value": 1507328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699564923, "uuid": "9e7f1762-7163-4bf3-ac34-dad48de8b039", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699564923, "uuid": "90f14da7-41fb-4991-8832-dca535532a85", "value": "SecuriteInfo.com.BackDoor.Attack.737.10343.9757", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16e355f3-7ec3-11ee-8907-42010a9c0042", "comment": "Malware payload (Heodo)", "timestamp": 1699508686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699508686, "uuid": "d2eb55ce-9576-411d-9a56-7082e1b8c326", "comment": "Malware payload (Heodo)", "value": "f61d67421aebd15a4e3fd34ba7609b08", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699508686, "uuid": "aee08712-6d64-4815-a907-b8f92cc52b13", "comment": "Malware payload (Heodo)", "value": "80d0ee6c3ad44a67a1509516f6f6afbfd3d93c300511a5b3dda2ae101f7ba8d0", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699508686, "uuid": "cb761939-d2f6-4680-8cdd-b8a10b41c90d", "comment": "Malware payload (Heodo)", "value": "0ffb944e32f9999ca6bd44db66c3b7230df4ba71", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699508686, "uuid": "9000c9fd-150d-4304-9987-328cb8475c33", "comment": "Malware payload (Heodo)", "value": "04b63c4e0ab5e012659ab770e7160fd363125303cd322487746fcdf93688cf9f19a9984ce425ee5001c3328e03d16a7e", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699508686, "uuid": "220afd7a-d64f-47c7-a0e2-c3c073c1bb03", "value": "T11E64F94352D37C55EA26CB328E2EE6F8771DF9518F0BB7A51259AB2F04B10B3C1A2711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699508686, "uuid": "67290eea-1b40-46ab-9f3d-d4900788aad8", "value": "b7e07a5800cbc9c6f303fe6cbe1b23f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699508686, "uuid": "72a45489-a04d-435c-9a97-2ee6adf39519", "value": "3072:XjFcmwc50swsaHoO8dJH2yWleBpuLk4ZV7Y9qFO8rAmpkgk9HAHsEz:TrF5f5koO87NBpaVEozAOMgH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699508686, "uuid": "994b978f-8ca8-47e8-bfb9-1e92c32c5bf3", "value": 331776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699508686, "uuid": "f50724dc-31b2-468f-87bd-fbe0ca5721e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699508686, "uuid": "54db47c2-e6b2-4d0a-a628-22fedc42525a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62e2da9f-7ed0-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699514397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699514397, "uuid": "dccc3cf6-c749-4686-acb6-2616af63094c", "comment": "Malware payload (AgentTesla)", "value": "e6650ee070187bce6b28a59f0d2648ee", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699514397, "uuid": "f0d4a62c-a3b0-4858-8c11-0e615da92b06", "comment": "Malware payload (AgentTesla)", "value": "814d447f96169b43f4cbf6c80764eab8316ec398628d1c1997b82039f446a5b2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699514397, "uuid": "af8974c4-f64d-475c-a824-2150c1ff23ae", "comment": "Malware payload (AgentTesla)", "value": "cab204cd3c3e6f673f29f62d0f3c2db2320a27fe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699514397, "uuid": "c8590429-a39e-46ac-8e48-d0fcfb816ca5", "comment": "Malware payload (AgentTesla)", "value": "ece63898c6f11e03e32a3ca1e6e98238253b9091c534b025b6ac514227a894d0b2f1f010b2387a55c572d8b04cf01ed9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699514397, "uuid": "027f7e9a-df0f-4858-addd-a4301689c46e", "value": "T1A924BF52FE41C606E414437589F74BAB6325FC819F924B0F324CF71D3EB06A56E2BA62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699514397, "uuid": "dda229b0-55d1-4c8b-9050-44c8f8d5d940", "value": "6144:yFJ9yY35qAOJl/YrLYz+WrNhZF+E+fgL+0dD8ivSbV2SoaMIR0ylw:gT3bV2sMImylw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699514397, "uuid": "1611895b-235c-44aa-a349-bf1c67320390", "value": 211456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699514397, "uuid": "3b6bd932-6c3d-4ab4-94e8-35dd1a34b20f", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699514397, "uuid": "9c2cd778-6557-4b4e-a604-80194ecfca83", "value": "00809808686cotizaci\u00f3n.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48c2a4b7-7ecd-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699513064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513064, "uuid": "50a331d8-190d-4f24-91f4-887da4e2d226", "comment": "Malware payload", "value": "2bd707161228c55b3f1a25d03f9a35c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513064, "uuid": "8877c66d-b438-44fb-aa96-57d1e265a80a", "comment": "Malware payload", "value": "8193eb3084fc702fd9bfa226488a199ac3274bfd0cbc8f8850ed303cd0396b63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513064, "uuid": "049994bd-1da7-4326-b7b9-adeee893623f", "comment": "Malware payload", "value": "d8a3ef01fb6e8d56af6b59e5f69f2b43bf50f400", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513064, "uuid": "667b1ffe-3440-47bc-bfe1-23a6fa4819fc", "comment": "Malware payload", "value": "682d754313c9486d46d60df35c0b067d141285a6b408495e9d6d14887ab9b013daed27bdf46f08af6a9d33a6c5c2216d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513064, "uuid": "bf2054c2-66e9-41aa-a2d1-561896d1f96d", "value": "T147E3D717B69A9AF3C2A85B36C5FB5110077CD981B263E70E754E23DF08437BAAD4460B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513064, "uuid": "70cb4562-9e89-4ef4-af2c-70c490d7a2f8", "value": "1536:dYIbLcFHA5MoGEC8NW6xqX1rWHpUhDFD+RBjQ+l5ombffSIY/B+JwNHcayUBsL2G:arNFCRBBPoiXSz/B+UHkY/sHqXi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699513064, "uuid": "d37ca8b7-0610-43f2-8b7a-2d478333ca98", "value": 150528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699513064, "uuid": "91991d9e-5a52-418e-944f-0a1b664ca4c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513064, "uuid": "330c25c5-f0f7-4def-abbb-7a92831f8051", "value": "ZHENG HE 2 - 20564-Quotation.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1572b9d-7ef1-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699528702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528702, "uuid": "ddbf01c7-f1ad-41c8-bec3-8260778d949c", "comment": "Malware payload", "value": "eabd937b07b489f11588a8d5d2315f3a", "object_relation": "md5", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528702, "uuid": "bc1b0b92-db5d-45f6-a470-cb54181d0424", "comment": "Malware payload", "value": "822a6978a4df8f12c56ddfde8d102e39ddb9e8f3d5cec813eb4f950288c240f7", "object_relation": "sha256", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528702, "uuid": "823a7e10-914e-4b10-82ee-3ae9051a7e35", "comment": "Malware payload", "value": "0e2dcd59cca00c329e2a2e41baae5b4b085577ef", "object_relation": "sha1", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528702, "uuid": "069598ab-3c39-42ba-a8d1-2af99bc75b05", "comment": "Malware payload", "value": "8ff3532c7b974aa71279cdc2f1bb86d5a8e72871689b172400f1a0624aaff6d083d116323fd105e84b0b7cb788808e2d", "object_relation": "sha3-384", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528702, "uuid": "8efcb862-3a05-4575-84b9-822785e7099e", "value": "T17892D17C48064914C115DD38BFE134A77FD795E8A62007E83628728DB23DDA76E0BABD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528702, "uuid": "2c524a74-f9ee-490e-84fa-b71ed4e6287f", "value": "384:WGZmzs+dqbQXwl/XBm/+c/uaxfuPAeb0pnhB65ys7Hy13NtAlo:WU+dMQAlP4/6axfuPARTs7Hy13Alo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699528702, "uuid": "624e3643-b1fe-4c40-aea2-b688eba9bd35", "value": 20850, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699528702, "uuid": "e478726a-abc5-4bdf-987a-e9bb4cc8288b", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528702, "uuid": "7c0c6aff-b602-4668-a8b0-a060f1435af5", "value": "nhesap hareketi-01.pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bff37704-7ecf-11ee-8907-42010a9c0042", "comment": "Malware payload (Loki)", "timestamp": 1699514123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699514123, "uuid": "519b2f39-dd7a-4071-b215-366021bebfdc", "comment": "Malware payload (Loki)", "value": "0a7881cf31a985820d24e569635b30be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699514123, "uuid": "d998e5da-c7d3-460d-bd1d-0bf8e9e739bb", "comment": "Malware payload (Loki)", "value": "8408bef275178e6ee9528f063a5a0723c5be17889b0a228be59dac30e413cbaf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699514123, "uuid": "dc6fbb3b-f6ef-49dd-9945-edb357533b12", "comment": "Malware payload (Loki)", "value": "3fc2f39ca01d1513ab068096d95c2e88a4ace94d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699514123, "uuid": "d23338dc-8f3c-4954-97e0-b0dbea229496", "comment": "Malware payload (Loki)", "value": "9e056c68fdc4ceeffdab936c39df397f37d51448ddafd4311bd23d4ba0b05f6dc5f2617518d7c4e7c1975014e2cb4b19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699514123, "uuid": "0f5e587a-49cd-4645-987d-e7a39c8319ec", "value": "T11674BEDC712072DED86BD476CEA82DA8BA61347B871B8513A01716EDAE4D897CF140F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699514123, "uuid": "ca27d6e7-9a45-4346-9e88-6c36abd21114", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699514123, "uuid": "32b72853-3e79-4fc5-a1d1-439965216558", "value": "6144:b4C6usKDD/7CGiRwz5LA4oJz1ZWnHx6CnanxrVXJSQQx/jRCwKh4nipA3qx94uks:cCagbGGHfM5ZWnHx6CnaRNJSQIdQxWqT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699514123, "uuid": "c88f2bc6-7a1e-44e0-ac7f-021b245bcbaf", "value": 367104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699514123, "uuid": "eae47ed9-baaf-4ee3-95ba-d66da8d73927", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699514123, "uuid": "05a05e5e-e497-44bf-936f-56ca34a4732b", "value": "0a7881cf31a985820d24e569635b30be.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ac058bc-7ecc-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699512611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512611, "uuid": "a6a575eb-feb8-4314-9c78-c93b11e52c76", "comment": "Malware payload (AgentTesla)", "value": "f0fa7dc8f8d876dc67555344ce96494e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512611, "uuid": "38f275f6-1107-40b5-bbb0-b2b81c3e6e7c", "comment": "Malware payload (AgentTesla)", "value": "840d9624ba46b0ad6d7271f3e0e6235672db0961ab511ccd97d65fa0f94d2191", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512611, "uuid": "ecec6d33-44a1-4592-8ea2-80f853c41404", "comment": "Malware payload (AgentTesla)", "value": "158e89868aa6b5b084ced7c16a0ec28c6f40d80f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512611, "uuid": "3c693b83-574d-433b-aeee-c8ec717e9fcd", "comment": "Malware payload (AgentTesla)", "value": "9f6563b55decaeea1f745ce7351ae4849adf9a5a0d0b4df8324073cf6345b3d438f5e34ac1cab3e6fec2bafb4f264dc8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512611, "uuid": "10a108c8-355f-408a-8d0d-acb68fad0cf9", "value": "T10EF4BF643B744173CE84CA7195E25A46C3F3AEF827E1675A2884766C1B72BBC8F036C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512611, "uuid": "90b8e2d4-5ad3-495a-9f6b-51b0ac99d160", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512611, "uuid": "27f83ff2-0c6c-4460-b57f-ee0c3835dbeb", "value": "12288:gpSOZJos84e61elDTFETMIG9tzsA38zjsJWWRfeMGnDZ:Cos8kxgCA+sx0N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699512611, "uuid": "c916f167-f1a9-4e7b-a5c7-f784c4b0eba3", "value": 773904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699512611, "uuid": "761ae120-06a4-4382-b451-32b47df46fc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512611, "uuid": "989a0458-9377-4623-a038-c6691f7fa179", "value": "PO OAU_NOVQTRFA00541\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee1ba5c1-7ecd-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699513342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513342, "uuid": "8e6cae6a-341b-4362-8a0a-dc7218ec2063", "comment": "Malware payload (AgentTesla)", "value": "e53bdbbb1f9ead1eab68af538a6b033e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513342, "uuid": "190a7f61-101e-41e5-87ca-09133b44e3ea", "comment": "Malware payload (AgentTesla)", "value": "85626dcaf2515306c4f03b2ee34eb5c1202eb6aeb475dbc7fe8ca4ecf8fa1d72", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513342, "uuid": "64d97e02-a658-4322-892d-1070c79c3573", "comment": "Malware payload (AgentTesla)", "value": "e3f64da986ce4b1e54c7aced033677aaebc56e24", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513342, "uuid": "aa59174c-106c-4ace-8011-4dc1b9fe4862", "comment": "Malware payload (AgentTesla)", "value": "5d1af38416b0b907011ba144bf2390067b4b8cbce0428df246901095244d482aec5cb0f8fd126659057d396f9bc36424", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513342, "uuid": "50f08805-13db-484c-a94f-0b55e635f79c", "value": "T1D7E4CF0976745233ED14CA3819F25E15C2E7AE6E2FE1A21D24C4B26D1B326FD8F176C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513342, "uuid": "ede41533-98d2-4bad-841d-0a02321c9a81", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513342, "uuid": "3712527f-46aa-4c8a-b3ff-f968010e39ea", "value": "12288:ram6w655lJGZXxvW8GbYLDKBXVSjzfan61:Gm6w6WZhOsLDK3Sj7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699513342, "uuid": "beff5cb4-98aa-4b48-ad2c-8e0e9c0d4f8d", "value": 721920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699513342, "uuid": "a442f3d2-3a2e-44d6-b1a4-6c1e6bd9195c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513342, "uuid": "d25bcaed-1f3a-4c27-81c9-f2a9baf41bcc", "value": "ORDER LIST_NOVQTRFA00541\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f39078eb-7ecd-11ee-8907-42010a9c0042", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1699513351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513351, "uuid": "ad5d01eb-25b2-4a06-b735-7432c53dcd22", "comment": "Malware payload (AveMariaRAT)", "value": "25558b1bfa89ebd1115c2a22bdc9b596", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513351, "uuid": "0c43c46e-8c9d-4b7c-a5ec-b1d182c58ca7", "comment": "Malware payload (AveMariaRAT)", "value": "85cb14397d774327adc351efb333d0939906d00ce960da1876ac22bcac94ed04", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513351, "uuid": "61c6c5d1-0a01-4f6a-9c2a-24464dcfe1b1", "comment": "Malware payload (AveMariaRAT)", "value": "d42ed9c4a1ef72f0ecf72549180e5f3a1b34a8ec", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513351, "uuid": "2fba7669-8073-4ebe-9b51-657d96b1b88f", "comment": "Malware payload (AveMariaRAT)", "value": "4dbd599383d063c58cea28989c1ebbe5c925e7c7f892872cb6434259e8987200c0e6c8b8b80b7b1c897b47e596d4ed85", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513351, "uuid": "371d7ee9-10f6-467b-ba55-2a9f0180d79e", "value": "T1B765F7037A6686A2E6489F32D1D76C048363DDC272ABD60E7989335596B33BF9F07107", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513351, "uuid": "691d37da-2b2a-4036-8427-4f5bf5bf5830", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513351, "uuid": "955c3985-63bc-4840-ae22-41fed678645d", "value": "24576:p8haKm6GdixcI84NS/ybcMC9oAHErmeEK:94tQybf8Ob", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699513351, "uuid": "e348ec63-0ac6-4e8d-9d3c-ef335eb1b16d", "value": 1438672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699513351, "uuid": "8a4901a3-92ce-49ea-b6d5-0f6e3a4f4328", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513351, "uuid": "1e46158c-8b99-4086-8208-a436efeac9e2", "value": "Purchase request list 2062566977\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75c9ca48-7ef2-11ee-8907-42010a9c0042", "comment": "Malware payload (ShikataGaNai)", "timestamp": 1699529031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699529031, "uuid": "bb19b244-6764-42ce-80b2-36839d583307", "comment": "Malware payload (ShikataGaNai)", "value": "3ba7c67d03894367113ca5e63003b816", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ShikataGaNai", "colour": "#554481", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699529031, "uuid": "d249c484-9048-4023-8282-92c5f2d654e4", "comment": "Malware payload (ShikataGaNai)", "value": "87b01301e8951ba179d13f5fe0a4f1dfbb19ffe670d9a532380e461dfb8737fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ShikataGaNai", "colour": "#554481", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699529031, "uuid": "87660d0f-15a3-40a5-9fc1-05074b94e11e", "comment": "Malware payload (ShikataGaNai)", "value": "7c169fe72d534ee88d8dce96f1df54a89637cd04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ShikataGaNai", "colour": "#554481", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699529031, "uuid": "e9404fb2-da76-474f-ab97-c62abddd9a47", "comment": "Malware payload (ShikataGaNai)", "value": "b3aee908e770a974957b1043a19e60ab32317ec3c3f71032d924624d84efcc04631380b40820c04b6d44181391499bb1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ShikataGaNai", "colour": "#554481", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699529031, "uuid": "810e8613-bb50-48cd-b81f-72b98627b028", "value": "T1C973BF43D5C00426D1E2227D6B752AB5A970F0F63215C2DB798CCDE9EFD09B0A6267CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699529031, "uuid": "caa5179b-4ceb-4f67-9586-04393eb07e2f", "value": "481f47bbb2c9c21e108d65f52b04c448", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699529031, "uuid": "8e68e444-2807-4ade-b416-8e6cee0860f6", "value": "1536:I4Zu7AZ7SeSSs11tTK09VSVP1ie5Tbg9p94DkUcbOMb+KR0Nc8QsJq39:HAgyV1tTlsVfbg9pjDCe0Nc8QsC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699529031, "uuid": "9e384dba-0206-4112-ba41-4e63c7edb659", "value": 73802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699529031, "uuid": "2cdb4d63-b891-4922-85d7-4386b5d34a7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699529031, "uuid": "80278413-5d5b-49d2-b4b0-3d3a1edbf9da", "value": "87b01301e8951ba179d13f5fe0a4f1dfbb19ffe670d9a532380e461dfb8737fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "150307b9-7f1e-11ee-8907-42010a9c0042", "comment": "Malware payload (RecordBreaker)", "timestamp": 1699547767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699547767, "uuid": "50f47215-eb33-424c-abcd-91cc02d372a9", "comment": "Malware payload (RecordBreaker)", "value": "dc00582614832bb3bc6940be5383858f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699547767, "uuid": "22f5f056-598c-425d-9add-95bfaf029a8c", "comment": "Malware payload (RecordBreaker)", "value": "87ba028eeb38b0d4e98f021c9c2d456306237050acd232b9bfaecf50979deb2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699547767, "uuid": "4fc25c9f-ea01-45e7-b4f7-701d49a74e78", "comment": "Malware payload (RecordBreaker)", "value": "1b3e6eaef63dd480ab86a5c9aef8aca8d70d0029", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699547767, "uuid": "604f2229-ca40-46ed-9e51-ada741652594", "comment": "Malware payload (RecordBreaker)", "value": "26e72fc89f9de51c17eaffc8198738abcbe49fedb011a5cd50ba08cf7c6ddac9eef79f284fa1d460b2ce317385347028", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699547767, "uuid": "cc9ce3e8-0331-4d16-b199-cbc50e1f5a77", "value": "T1530633F70F133A94D5F6F5301CDADBA67818B92617061E2B51880A7FAFD1A840E275D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699547767, "uuid": "aaa8a628-d54b-4dbe-999b-4a3a0d69e4b6", "value": "2c948f84df90d09d5ec0ed0cc0486ab7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699547767, "uuid": "50eb43e5-ac53-4559-94dd-85521fbf1ee8", "value": "98304:p+VStoE1ZwxvEpK4EcIBb/7P1cLxU3L1vKa/tpoBt8NreG7p:cVSNZMvEp5MBn1cLxKL1ilQrd7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699547767, "uuid": "e6e21a27-8409-4448-a724-a7a270c18fe9", "value": 4017152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699547767, "uuid": "7680e848-78b0-42b8-b7cb-083e4fcb4542", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699547767, "uuid": "bdaeb9ab-7bf1-44f9-801f-cd80e98bac72", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02a5c947-7f3e-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699561480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699561480, "uuid": "57464bcc-3bd7-4102-9001-8eb5b83d18c3", "comment": "Malware payload (RedLineStealer)", "value": "f4a3bbb27c7062c06350ba3f7ec0c1df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699561480, "uuid": "100476cf-c575-42ca-948a-45e98716969d", "comment": "Malware payload (RedLineStealer)", "value": "8819a512782f2698ef25abeb0dad04eb0821540885ff5feaeb7910ee8562e879", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699561480, "uuid": "86b71c99-123e-4644-99a0-60a2da8515b5", "comment": "Malware payload (RedLineStealer)", "value": "66b7d6d902fc14e3457c3c15b84808ef22e96cbc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699561480, "uuid": "673cefa5-5672-4da6-a14e-8c8c35f0ffe8", "comment": "Malware payload (RedLineStealer)", "value": "cd39da0496379b9d356a3ac4ace33fb7f11fd518ed9073e00c2ec92c78a0a1ba20a1e32a879ff597a830c5bf491ad821", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699561480, "uuid": "4b51e742-9db4-48ec-807e-f020085a9c1f", "value": "T16FB41243E7E90133D9F41BB059FB07930A3ABDA24DB4925B2742A95F0C73685A43673B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699561480, "uuid": "faf4410b-d8bd-4d0d-9be6-7587bb80a290", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699561480, "uuid": "495892f5-cbef-48ea-846b-59c6fdfeffdd", "value": "12288:IMrzy90GdJgReshK4ybmbstk0JQEVk4IxHswPrk2NA8Zg:7ybJueSKj6stVB240Hswg2nZg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699561480, "uuid": "51636208-28ad-46b6-b7b5-31b0c7097766", "value": 527360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699561480, "uuid": "d0aabb7d-3d13-4100-a132-8cd91e407b0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699561480, "uuid": "e9dbc821-0bc2-4a7f-809a-366e48d66b07", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5be3c10e-7ed0-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699514385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699514385, "uuid": "7d5af113-9ab8-4cae-b475-a9ddf10a2b60", "comment": "Malware payload", "value": "1f64aaad993f59626040607da19fc19c", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699514385, "uuid": "29c12387-1e8c-43bc-ba17-afa85e85cf18", "comment": "Malware payload", "value": "887c9a35ea71672843dfb72537b8c3a3f6093daac361f4f32055de8eab8c4407", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699514385, "uuid": "7f234e82-b7e9-47a6-994f-e292305069e8", "comment": "Malware payload", "value": "4f0228c3ce0456527198599b1feac4b09c25bfcd", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699514385, "uuid": "25cab739-31cf-4cd6-9f71-6491a7fdb2ae", "comment": "Malware payload", "value": "60d96e1ad12c581393ee8d9076caa7942c65435fe5120ab4abedece34ba6789fc74587ac4d8c518e9b06b0bfef5cfd51", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699514385, "uuid": "60c8cb24-ab2e-4607-ac5c-c10934d9a469", "value": "T13394012CE544B47CC2A6373C922828F0564DB4C1A41AA79B3540E4CDCB766DF8B49BAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699514385, "uuid": "b44535cb-f3e8-47c7-ac6a-ad7b84db10ee", "value": "12288:yTLnyTuMtN3Wu6hGuvPZ9SKvKsa3donu8qicggnhSP1pn:yyiMtxWLGAvSHs6donu8qicdnID", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699514385, "uuid": "fc34d0f3-f7c2-4d83-9bbc-f5a5f9b3e581", "value": 439069, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699514385, "uuid": "b1ec6ae2-8a7d-4a69-93a4-16998ff6ecc2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699514385, "uuid": "538795b1-cdb6-47df-9105-7796d1f5ad84", "value": "st9007220650510603.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb6328d3-7f0a-11ee-8907-42010a9c0042", "comment": "Malware payload (DarkGate)", "timestamp": 1699539456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699539456, "uuid": "cc66999f-a3f7-4921-8b68-c03136ee2745", "comment": "Malware payload (DarkGate)", "value": "be421d1cfaba686bcafee896c24b4b45", "object_relation": "md5", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699539456, "uuid": "6e0f7892-283c-46c6-ae5b-9080c8b48a63", "comment": "Malware payload (DarkGate)", "value": "893bb5ccc58e1d3ab7d2e28a5ecbf58195d10bc352f800b65d905c9655158439", "object_relation": "sha256", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699539456, "uuid": "2b9ef43b-ad61-4bf5-b6b3-24a4ea91bf68", "comment": "Malware payload (DarkGate)", "value": "f89fe47d0ae4d708876e3e80c250eef6582f148b", "object_relation": "sha1", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699539456, "uuid": "e50d8492-18d2-44b8-a6ee-12ea13caa1e4", "comment": "Malware payload (DarkGate)", "value": "a998b146a103398c4359cbb63ed265a08c2804c43e89fd8cff491b3508dc72c6ed2e81db4f74e9b7488e24a8bc84e777", "object_relation": "sha3-384", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699539456, "uuid": "b1ffa13c-b141-418c-977a-773393d02062", "value": "T12596332522D9C736D18F2332819BAAA13354BF641BA0C0CB2B94757D25B1BF2DF35B46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699539456, "uuid": "e4a53630-d328-4c3f-8590-5e1c44cd4e23", "value": "196608:PeS5hV9/S6WXbfXlTrn7HZ5AQX3AveLukj1w9+MeLGW+x:PdhVs6WXjX9HZ5AQX32WDa8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699539456, "uuid": "ee1e46a5-1676-4577-9b93-cb0c212bf23c", "value": 8908800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699539456, "uuid": "9b9d71a6-3076-4798-bbe3-310ffdc0911c", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699539456, "uuid": "67abb1dc-146b-4fd7-8e3e-aa532c6dc98a", "value": "startapp(ffb8a7da0da).msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04c6cd3e-7eff-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699534425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699534425, "uuid": "02769c9d-e501-4512-ad4b-74841e2f0062", "comment": "Malware payload", "value": "1377ef7319507a10d135d5128ac9fbc8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699534425, "uuid": "c8185804-e4e5-4e29-9e1c-11e84cb97d4e", "comment": "Malware payload", "value": "89c61b5b70d806f603c431365f11f5faaa06f4ce34fc8006fb7ed026a2efdde4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699534425, "uuid": "af2e65c6-b14a-440c-a3aa-69194b57256b", "comment": "Malware payload", "value": "dc4983edae51b3b8fa4b9b28c621e3dec41888ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699534425, "uuid": "008dce7d-9349-4374-82b2-14e06a137751", "comment": "Malware payload", "value": "f80a462bbab03517ea774e08df537910c3d760ba35d6a7b8b2f24838065e2f89b12daf2e9e4fb8f42b0fc1bd1ee684d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699534425, "uuid": "f9f51e03-1460-48a6-b489-6e99ba5b3aa6", "value": "T116069D217B918C35E2B33231856DE379A7BABE306F758A8B11511A3D2E345C2593C73B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699534425, "uuid": "9ff1214b-9060-4855-8598-29a3f5d56876", "value": "1808bf6dae531b63095d6e441d4dbaf2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699534425, "uuid": "7046205b-60ba-4589-ba83-4583e17b6c93", "value": "98304:lrzi2j1z73pcO9s75GmJRfdlSN6Zk/dztxQmsw6J7RmVWK3RYpQe7tC:1VIGIdlCtZszmVWK3kQe7M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699534425, "uuid": "7d6d4dcb-10f8-43ee-9fa8-d4a09437bcc4", "value": 3654872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699534425, "uuid": "6639fe27-dbd3-469a-9f4b-eac08cb73ee6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699534425, "uuid": "41808f91-bda9-43b5-90d6-126db28dc4b0", "value": "89c61b5b70d806f603c431365f11f5faaa06f4ce34fc8006fb7ed026a2efdde4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c176761d-7ef1-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699528729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528729, "uuid": "c7fb1eb6-8ae7-4590-8442-da9aa4a78151", "comment": "Malware payload (AgentTesla)", "value": "145c06100e4d43df9f792814ecb85fcb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528729, "uuid": "cc991abd-28ef-4645-9975-7aa1509a6e25", "comment": "Malware payload (AgentTesla)", "value": "89e12739c134c325bc51d78803b07466e1823d8d1477813e3d93c960573af165", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528729, "uuid": "b08252a1-0602-4112-99d6-d6198bc63541", "comment": "Malware payload (AgentTesla)", "value": "28ee1e461e406d41632871dbc8c8cabbc8dc7932", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528729, "uuid": "6275090a-0f24-4067-98ef-c2ba3d515c50", "comment": "Malware payload (AgentTesla)", "value": "dcb5de2abcd8a00d274f49fc6fe4ea778cf01232515d328075e9eb0670b1cefbad9e99670cae1851bb1bb62f83a4d07c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528729, "uuid": "5be09582-466d-42f7-b9b9-d3ad8940614e", "value": "T124C42307B9A8CA09E0AB1FF50C75528413F1E1A3AA1BF7BEAD6550EF9D1E74444D0E23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528729, "uuid": "2558e9ef-4850-4a2f-bf3b-a91ad82fb728", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528729, "uuid": "adf50960-24df-48ce-abd3-76252938c308", "value": "12288:BRrMOY7SkD0iy5lsRdjbV9154EWYXQdpmXq5qoCX+c053GT:nnYJBy5lsfhliE27SOxS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699528729, "uuid": "5b79bffb-2bcb-4078-8e27-46829561478e", "value": 594944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699528729, "uuid": "dc0c27c1-187f-4de8-982f-88b7eeb66ff8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528729, "uuid": "2634fb19-7cdc-4da3-8739-1afefe5feeec", "value": "z1RfR6rGLeH6GroAJ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1dacd58-7f09-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699539011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699539011, "uuid": "1de5983d-4b5c-4b2f-ae8f-705caebfdd97", "comment": "Malware payload (AgentTesla)", "value": "d55d5eb77f75b75d4a957709d3cd0903", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699539011, "uuid": "3a735457-0671-4c3a-888e-d64621c2e3bf", "comment": "Malware payload (AgentTesla)", "value": "8a7a104c4a8081587a59840cfa3fec585839118bc015c2f87cb7d68a819e60eb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699539011, "uuid": "b4793aa8-3787-4271-91a0-97e9a52f397d", "comment": "Malware payload (AgentTesla)", "value": "942d9095e6abf7fb7a38a219af7559f036347a6f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699539011, "uuid": "e0db10dd-5776-44a6-b69d-bde73360bdcc", "comment": "Malware payload (AgentTesla)", "value": "31245b1458b0c409f51f4d5bd73b98ff88948c644f269fb9f74d73a799355370ed48864d4a477ec9b735b77ef9a98380", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699539011, "uuid": "31e80fc7-01fa-424e-b825-9ac2e08b9268", "value": "T177D4221A662D0017CAAE04FEE9426F8503F5B9196094F3D96D8077DA07CAFC148A77AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699539011, "uuid": "bed8f541-e9c6-4311-a877-7ac69c80a294", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699539011, "uuid": "7ce41968-387d-45fe-b353-0cf9a9072c96", "value": "12288:YYHgoZFF6r3irQ7Or2Ncer1oUK8MSsYsR+gBoZmYDzYqmgS1S9HXOweNEfzgC:XHgo7FBriN7jK8xsYufY3YqmgfeweNyg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699539011, "uuid": "6f5ed189-0880-46da-98eb-48bba367f318", "value": 619520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699539011, "uuid": "0f6c14ce-4108-4263-a12d-d47c13473292", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699539011, "uuid": "b6c15ea5-818d-4d18-a83f-6a67de469130", "value": "QUOTATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42230a2c-7f24-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1699550420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699550420, "uuid": "e3658b93-1f98-469f-9193-2ef31a76f5f6", "comment": "Malware payload (Formbook)", "value": "c0b99bd45fc8dc88559f328f5179163e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699550420, "uuid": "8d80b9ee-9cff-4509-959d-b38166da3189", "comment": "Malware payload (Formbook)", "value": "8b2f4933b09675c064d43be29eedb0b1889a99d9fb2efe91af0abb7a61974e3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699550420, "uuid": "564b5dcc-d30a-4466-ba17-7a1af32bfe4d", "comment": "Malware payload (Formbook)", "value": "a88a4b325bc37f750e74da1a1937850a07ce7625", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699550420, "uuid": "07d18845-2146-4ca1-af20-37632c74be63", "comment": "Malware payload (Formbook)", "value": "5cb716e10b3880cc3508d34f22d1260d03d603464c694f0dca9d67f1bed01fa324626e5ad11e15f86501e512caab8627", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699550420, "uuid": "e2dff6dd-18b0-4de6-80cd-142dacee7315", "value": "T14D74221A92928CF7E313C1F24DABE2BDFF1FC28A7526451747E5BB370920686164B1B4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699550420, "uuid": "9cfff0ac-db9e-4efa-a559-cb1f448aff76", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699550420, "uuid": "ca4b5ad3-3d8f-46eb-be04-d4c5bfc107f6", "value": "6144:F8LxBsFJvMaNQB2+qFXaLQvgpP3RFhyFrBmvmZZRKf+m/BQQBxAaDF0RjSDmx:/FqRq9nvkvrhK0MZKJBQQrAa5ejSw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699550420, "uuid": "34662b50-436b-422a-ba61-ba9b06758141", "value": 354142, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699550420, "uuid": "dec6ac78-c203-49aa-9839-639c27163a77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699550420, "uuid": "17a3a200-178b-4823-a6d1-9b64ab64c8da", "value": "PO 44223.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1056741b-7f20-11ee-8907-42010a9c0042", "comment": "Malware payload (RevengeRAT)", "timestamp": 1699548618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699548618, "uuid": "9a1f2f02-1128-4ee1-ac24-6d7e76050dda", "comment": "Malware payload (RevengeRAT)", "value": "4c1cd8c65d43037fc0bcd17662c1f9c6", "object_relation": "md5", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699548618, "uuid": "7dc8f306-0ac3-484c-966a-1c2e75b485c5", "comment": "Malware payload (RevengeRAT)", "value": "8c3a544deed6af86417f4cc0e31d214dd56641c1f18c267d9eb19bfd82c8848e", "object_relation": "sha256", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699548618, "uuid": "976d6803-6f3c-4f05-8ee6-72da1b7a7f80", "comment": "Malware payload (RevengeRAT)", "value": "1b8b631b60317e80e82d3fd23e1b417018949e61", "object_relation": "sha1", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699548618, "uuid": "53946896-7bd2-4a65-a5ca-c6d5f863fc89", "comment": "Malware payload (RevengeRAT)", "value": "02c5506abadf8e232c48f277688f5b75e76e45b6b8e510a54e2a7de29a97a65639642c27240a612ba4c70fac2047335b", "object_relation": "sha3-384", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699548618, "uuid": "16256daa-3ed8-414f-9a56-be0459916fe7", "value": "T1E8F16C56E6070654C362C779C76EDC7F7A76798C3919B2CA7298F10C4F811C3820BEA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699548618, "uuid": "78a66b8b-78f2-46a4-bb3f-303a49686078", "value": "192:xrXP/y+e7ccMqWotvM+wvZAQotaaP5IC5Ulp5:dXPJcMFAZta2uC5Ulr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699548618, "uuid": "03225088-f72a-45c5-8bca-c3e0fccc925e", "value": 7939, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699548618, "uuid": "49868dbe-134f-4d85-821e-8648000cd178", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699548618, "uuid": "0df4ce6c-ff7f-405b-a540-1f4edcf81375", "value": "Reserva.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc595077-7ef0-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699528318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528318, "uuid": "befba821-d3ec-4aae-9f58-23b92951eb20", "comment": "Malware payload (AgentTesla)", "value": "3dd299068013da51e3ef7e4d6ce0753a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528318, "uuid": "afae7089-68a3-4ee3-bf6a-26c044f688a0", "comment": "Malware payload (AgentTesla)", "value": "8c6b81a7eb5b33af1522fe1fc4be9b1f30b91934e8246127a61533131cc4c804", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528318, "uuid": "971e2526-91ec-4d80-92f5-d27079632ace", "comment": "Malware payload (AgentTesla)", "value": "cb7fa4cec4456551798187d9f2d26853d6648d36", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528318, "uuid": "4b5e9e88-fa5d-49c0-8ea2-e1e1e70384c2", "comment": "Malware payload (AgentTesla)", "value": "a4da3defbb1fb667bbd2932877aead06ea19a116cb09d2903290d5d79388bb8d6550b1f8fed7db13444b482956cec6b1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528318, "uuid": "34ab3bd1-8b1c-4ded-a8dc-4f0317c4a19e", "value": "T1CF3410037E88EB15D5A83E3782EF6C2413B2B0C71633C60B6F49AF5618516925D7EB2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528318, "uuid": "b81526e5-3be0-4acc-8b29-98247886a94e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528318, "uuid": "f4488995-4ce0-400e-b1a6-dbc5a269af50", "value": "6144:c2uygwEfIE0kkksQhlFYbxV7NCZdmOqIRF:iygwEfIE0kkksQhlZZQO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699528318, "uuid": "a5ef9dfb-e427-4f67-867a-05d93405dbac", "value": 242176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699528318, "uuid": "9de17387-6716-48c4-bfc6-d958c9434e56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528318, "uuid": "c832a51c-f370-46a9-93af-465ed4ccea0f", "value": "8c6b81a7eb5b33af1522fe1fc4be9b1f30b91934e8246127a61533131cc4c804", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75638bbc-7ef5-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699530319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699530319, "uuid": "da833e91-1b9f-4f21-ae59-772d167f10e9", "comment": "Malware payload", "value": "5e9c4f50109c17fcfa62320764d81194", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699530319, "uuid": "71f78b0d-4ef2-44ab-bdc9-af2e35022ab7", "comment": "Malware payload", "value": "8cd808b9e0ee69ab9eece5285d90affbb9b164ff85b819b813c625a21dccc53b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699530319, "uuid": "d6a69519-04fd-4f51-b64b-4f78762afda1", "comment": "Malware payload", "value": "d991f6fdc4ac7c8e6a5f09294d652d2b3fd47c4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699530319, "uuid": "31350dbe-b046-426f-85f9-9d7b17e2f980", "comment": "Malware payload", "value": "044609122b11ce76a52012e3703157ae5963f09cce376053468a9d7fb2ea401cefeec09036641d95ad3f74b2fca72a9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699530319, "uuid": "5f754cf5-a863-49ac-bef0-c34a01b14046", "value": "T12D3423D18F608D61CA652E3D1CB2DD1ECBA4318787FE57B637B08478EAB9C672251188", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699530319, "uuid": "6409589b-fd26-4a2f-b5f4-77defbf04ebe", "value": "18c89e2ec0a399c68eaedd6551ce71fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699530319, "uuid": "c8a15e8f-fba1-4ef4-a17d-3f39953f5da9", "value": "6144:FRASGDlwrixVwF9EzFYjOOs8H0f2Ms9pvu4elKj:Fq78ukEpSCs0f2fzWA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699530319, "uuid": "86b74203-0cfa-4ac6-a692-ba60366f3c1f", "value": 250880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699530319, "uuid": "b2c27d59-6578-46e6-a036-8a3cbef9a9e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699530319, "uuid": "91547df2-79fa-46bb-a944-509056cc9653", "value": "8cd808b9e0ee69ab9eece5285d90affbb9b164ff85b819b813c625a21dccc53b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42d5c638-7f45-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699564594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699564594, "uuid": "991e3174-4f55-4d3d-9e78-bf308523e6df", "comment": "Malware payload (RedLineStealer)", "value": "b05b75408880e596734376c5b6ed2652", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699564594, "uuid": "720efb8a-dfb0-4372-a26a-fbfe09ea076d", "comment": "Malware payload (RedLineStealer)", "value": "8dfced75b6e9ed9ac48370b4736fb7b43fbfdaf3fe1e79483f5a535948697705", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699564594, "uuid": "98a7a82e-d1a9-45a6-a735-e5c0fa038d56", "comment": "Malware payload (RedLineStealer)", "value": "17e784d58547497064565d8a4f9beed899505e45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699564594, "uuid": "107ab1f3-109e-44aa-9a29-b7be8ee820d6", "comment": "Malware payload (RedLineStealer)", "value": "96558da57ad1df05894f943946a72ba3054bdc06ffc5113c2cf2cb6442b9664cadba3c612f4df1e80793d2fc4cec2c08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699564594, "uuid": "ebf7bdba-f973-4cb1-a728-ceb1c18c518e", "value": "T167B41213FBD89072EDB557B168FA02870F3A7C95A934931A33C4A42B4CB26D89935737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699564594, "uuid": "5d0d14bd-71fb-4407-a319-f205c3781b17", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699564594, "uuid": "51f9fdf7-04dc-451a-8487-5c5da9b2c258", "value": "12288:uMr0y90ReUVasXzONXtkwFU8Y8TUs2auF+4+wSROFLCeqPRqpPh4:yygeiXzONdpYSz2au4USIZtqZqp+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699564594, "uuid": "78e5181a-85ff-4f1a-b41d-844a553333ab", "value": 523264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699564594, "uuid": "86b020b5-a1b5-43db-b2e6-686c7437494c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699564594, "uuid": "d46f9466-6f1e-428f-9e95-135d583899e9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc561d1d-7ecc-11ee-8907-42010a9c0042", "comment": "Malware payload (PureCrypter)", "timestamp": 1699512936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512936, "uuid": "b3e902ba-b3f4-4657-a9db-8444058f56b5", "comment": "Malware payload (PureCrypter)", "value": "6fb6a18e8102ae469d04068260faeb97", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512936, "uuid": "0a700dee-acdb-4238-9c46-954872a24830", "comment": "Malware payload (PureCrypter)", "value": "8f5f25f83b2a1c09bab31017c94a5973065e5b3c43bc20e9569f061677d297da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512936, "uuid": "6414d620-f7f9-425c-9825-c03f8bdc0fc0", "comment": "Malware payload (PureCrypter)", "value": "085652d31a30090871f0e1a4f71bff4299d344e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512936, "uuid": "a059abb0-5d4e-4c47-a928-b42839a3d4f1", "comment": "Malware payload (PureCrypter)", "value": "f63505d8c8a65033c1e814d137bc6837ce203148e7bcb6aecfc7f611732c417c0602f5f67894001adde42c254fd0530d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512936, "uuid": "c0ce2462-1798-454d-af2b-859f9ffd8ae3", "value": "T100520744A7ACD5A3DC2B17FD88F747521A3AF6129809AF0B35CD730B2D42612243A75F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512936, "uuid": "fb5fc179-22af-4e8b-bf85-da4a0744eb9f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512936, "uuid": "88f4a740-ae1d-4f9f-88ab-dcab53e7b9d9", "value": "384:mZyysEoGqf8tN0gBqiiay9ycyrsR2vZW:moyRDegB4ycyrsR2vZW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699512936, "uuid": "dee22d68-b41d-4113-b8e8-3b4212f7c318", "value": 13824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699512936, "uuid": "8127e62c-1c8f-4d7d-89fa-416ec596c1c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512936, "uuid": "2b45397f-579f-4faa-ab1e-1df9c1b0443c", "value": "Product 2.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee145b40-7f22-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699549849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699549849, "uuid": "6705419a-8199-4098-a86c-c3c8edf1a231", "comment": "Malware payload", "value": "69785035cc45c215d54236d43b44ffdf", "object_relation": "md5", "Tag": [ { "name": "PowerShellDropboxScreenStealer", "colour": "#A62721", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699549849, "uuid": "014f51aa-6afe-4fb4-9fad-f47bc9273ed9", "comment": "Malware payload", "value": "90b27fc7fb415dcc69557b96ef2a2db50883753f11adb620e19b46ad5bccea7a", "object_relation": "sha256", "Tag": [ { "name": "PowerShellDropboxScreenStealer", "colour": "#A62721", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699549849, "uuid": "c8155c70-96d6-431e-9ff9-9759ab13c5f7", "comment": "Malware payload", "value": "ad8a5a90a118ee32f7105b45ee0905c1608729cd", "object_relation": "sha1", "Tag": [ { "name": "PowerShellDropboxScreenStealer", "colour": "#A62721", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699549849, "uuid": "067e5d69-9dd0-47d4-92c2-dc03d063f303", "comment": "Malware payload", "value": "37439572dbfadfdc56ab926fb513e2b163ce350330c87f0e6558f2c2ac6bbd4d52c067e935b6877961dc20eafa499349", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellDropboxScreenStealer", "colour": "#A62721", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699549849, "uuid": "3f4fbcd0-e9ed-453c-9d8e-77eaebc64711", "value": "T1D54196F2F327C1C14476A2779CA7D085AE78802D002059097ADCCDDAE7B19A06671F47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699549849, "uuid": "f9563a78-edf1-4838-b2fb-4e45f5f440e8", "value": "24:VJYcgZ2J3PNr1Vje1N7GFuNKOfvIPyIHWb3zlb19EZOVxD1cWyPsc3/FFO+gfjls:8cJfr1Vje11Z9IYb19Z/cPFFpgfepg4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699549849, "uuid": "0394dee7-2293-4edd-a0d8-2cd91902ca8a", "value": 1952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699549849, "uuid": "c61a48a7-b590-4216-b6e8-116c6cb2e0b0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699549849, "uuid": "9c1a3d1f-e197-4f2c-a70b-1e7a29997704", "value": "y9Dfb3g4.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb329e6b-7efb-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699533040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699533040, "uuid": "a1ce01f1-624a-41bb-a781-acbec5a687df", "comment": "Malware payload (AgentTesla)", "value": "0078dcf029269f5ef4788fadb3926337", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699533040, "uuid": "8d7c750a-faaf-4597-b6fb-65bfb5fead57", "comment": "Malware payload (AgentTesla)", "value": "90d9c203070aa9ee80dce9132414862bf917326d61385c98a05e21e44ef5c349", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699533040, "uuid": "7dec4470-2704-4e2e-b85b-2972cb297185", "comment": "Malware payload (AgentTesla)", "value": "2f4fc93c041722aa3bac71a2399ae4a704334ed1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699533040, "uuid": "6e03be1d-2a1c-44d7-ac20-ed771e5a6b13", "comment": "Malware payload (AgentTesla)", "value": "7448ee388ccb357f4716f13d47a11856e6eb1980140f1db0c2ad875b91ef75fbd2a63bbc3cb7c9240955b4a006f38e3c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699533040, "uuid": "6f459027-4ea2-45b3-a755-bab1fa4e5452", "value": "T162F33A69B2DA4D11D33D4078C9B111080AB2E177976FE79D0DF2ACFA3E163C3762A865", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699533040, "uuid": "ee652502-5af9-46b2-a11c-f94f231b3c37", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699533040, "uuid": "c3ba7b48-74f3-4729-9a6f-51d6a9010694", "value": "3072:JisUOGkFO/t7EVE+OsfAijH/MYK2IOAQAuW6scPhe:tGUONEVE+OsfHLvIOCtc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699533040, "uuid": "9c8a461d-549d-4478-a1c8-5c86ffd6935b", "value": 167936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699533040, "uuid": "cb6249bd-2026-4696-95e1-b9b419ec217f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699533040, "uuid": "a7c0c380-9377-41dd-9aa8-5f040539a302", "value": "90d9c203070aa9ee80dce9132414862bf917326d61385c98a05e21e44ef5c349", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bddfb379-7f2c-11ee-8907-42010a9c0042", "comment": "Malware payload (SystemBC)", "timestamp": 1699554063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699554063, "uuid": "200e4132-5326-459c-b94b-92e1665a9192", "comment": "Malware payload (SystemBC)", "value": "80929c8d2ecd8d400fed9a029f4e4763", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699554063, "uuid": "e870f40d-27ef-4883-b0a2-c01b73f79bb8", "comment": "Malware payload (SystemBC)", "value": "9199144c5156434c69d008c19562f9f6cf851720598c6550bbc2fc1f93e743ad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699554063, "uuid": "2be2fe33-7848-487f-9e78-f28795190180", "comment": "Malware payload (SystemBC)", "value": "4337a4fe00a10d1687d2cdb19f7c9aff4b05dd1e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699554063, "uuid": "af518779-9ae2-4fca-bbdd-6ab214211cdb", "comment": "Malware payload (SystemBC)", "value": "cafd3a4b43cf8be462bd82ff545eddaa8b79405cb79b6dbc4123f873722e591fe8a5cf61ae6d5c4b701cadf6abc21e97", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699554063, "uuid": "4b97e54f-0545-4971-92c5-00b0256078b8", "value": "T18B120667389195A2C313C2BF3B5F1765E07FA6736371A41CDFF00D617A32AA28B5604A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699554063, "uuid": "426bb7af-cc61-4f47-84a6-ca7dbec4beb6", "value": "765650190224c30d988bfe1c70e8de98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699554063, "uuid": "1217b100-e189-49ac-bfb0-0554257b5b98", "value": "96:kbzB1sIGNT8dfY4zbQbxkKYcsMWQAMIwcG9g5vOPEZ1eLP5FOzCVGSBXNBL7Kse9:kbF1PkUfY8LKMp5jeEZ1eLxkWksnO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699554063, "uuid": "4e6245b5-2639-4f75-9314-7bebf07e6bd3", "value": 9728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699554063, "uuid": "a5c51d05-f53b-42da-a4e7-7fc39b8b7e23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699554063, "uuid": "4d26b4ed-b743-499e-842f-651c3bfc05f1", "value": "80929c8d2ecd8d400fed9a029f4e4763", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4556d9f0-7ecd-11ee-8907-42010a9c0042", "comment": "Malware payload (PureCrypter)", "timestamp": 1699513059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513059, "uuid": "3a96e723-e400-4784-9298-29b74aa30b84", "comment": "Malware payload (PureCrypter)", "value": "bff0d06fa85470e6e7fdc36cfe7aa5ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513059, "uuid": "45470f3d-a55e-451d-a5f3-cd3fdc65cf45", "comment": "Malware payload (PureCrypter)", "value": "91e5e0059192afa409b9d5f3325cb519b4a68ff42a0c0476896054af555b2360", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513059, "uuid": "fb52871a-e732-429f-93c5-c6c501e82eed", "comment": "Malware payload (PureCrypter)", "value": "3dbf206a8def77c5bca192a86e2c2a2d81c419f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513059, "uuid": "65333f8c-04ba-43ce-90cc-3e1d19a51331", "comment": "Malware payload (PureCrypter)", "value": "38fa3c1ab85916b94ec86672dede019165fe1ce783999509deb37c0ee188846ca8ff7cd23f0870edbcba1d5416bfe145", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513059, "uuid": "09b3d6b1-b28e-43b2-b9a1-8cf8dd0f42e8", "value": "T1DC22D694A769EAE5C82616FD6CBB4B652A69B527DC458F0F34C5730F2C036225433B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513059, "uuid": "8f21abcc-08d4-46c7-8215-20276b56751f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513059, "uuid": "df33cac8-36c3-4d7b-9590-ae30e4535348", "value": "192:SM8wBg/W3B4tW1NZfiiLX2HS9yxSyrsRt8G3mSF6z4i:+wBNKtWliiay9ycyrsR2vZE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699513059, "uuid": "51719062-7a12-4906-b7fd-4faeded97212", "value": 10240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699513059, "uuid": "051c2499-1f51-4c43-bcf1-7cd2af8c0c4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513059, "uuid": "c955ef16-a6ab-4648-bf56-60764a344ecf", "value": "Galvanized Steel Sheet Technical Specifications.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f1f9558-7f1c-11ee-8907-42010a9c0042", "comment": "Malware payload (MysticStealer)", "timestamp": 1699547140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699547140, "uuid": "eeff4646-b2a7-47c3-a175-f23c76e89c1a", "comment": "Malware payload (MysticStealer)", "value": "ce5c8a09cb5a136b756076e18ad702df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699547140, "uuid": "8c38d77d-321c-49d9-ac0e-7afa86c98990", "comment": "Malware payload (MysticStealer)", "value": "92a1e127869518759ada2b8ddd3f72cb67ea2c6bd94e984f21b4dafa8fdf65a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699547140, "uuid": "6a34967a-742b-4434-be3b-de74035bf86d", "comment": "Malware payload (MysticStealer)", "value": "927465502a2d3fab1d0c04834cc295e6b9da601e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699547140, "uuid": "f74cacb6-5307-453a-a118-23cd94fe9afd", "comment": "Malware payload (MysticStealer)", "value": "ad1cf75a064a5e1a74a27b5eb6226743d121c77d4693c19bb8eae096cdc7d00a7672a62fbd288bf679cf84a78d90ebd2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699547140, "uuid": "7ce39da6-d0bc-4081-bd15-f2b9cd287d65", "value": "T1B874F142F7E98072E4B51BB058F606C31A36BCA25E74936F2745A99E0CB35D8A43173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699547140, "uuid": "56efbef3-1c85-4e9c-b8f9-ce863741191e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699547140, "uuid": "3d90a487-ba02-4785-9600-d2e22e1e4e7b", "value": "6144:Kgy+bnr+9p0yN90QEGf4wGMr2dWhut+0Ft/bHs8GS1lXUUjL4:EMrhy90of4EGW4pt/AzUjL4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699547140, "uuid": "fb701db6-3991-4b74-993b-97e9285268ce", "value": 338432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699547140, "uuid": "f77e04db-908b-417b-af1d-9069c06fbd02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699547140, "uuid": "c4acccb6-b4c5-4ae8-accc-69bcc1f14cd3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0917109a-7f46-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699564927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699564927, "uuid": "d515e3cc-f15d-45ac-b3b6-282bed841194", "comment": "Malware payload", "value": "4183ad446be1eb0d01fd744d62534d08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699564927, "uuid": "0fae2a5a-3c78-45e5-b81e-d52bcbcb8ada", "comment": "Malware payload", "value": "92b815f83119d9e50dac70cedac38f1ea41c9faee5b76d69438d2e77f0adee27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699564927, "uuid": "f18c2548-4ce4-41a1-ab73-aa07a1ea53ed", "comment": "Malware payload", "value": "bd209938be10875383301b79a820e339c2ed254a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699564927, "uuid": "1fec8074-a279-46f1-b8a4-11ffef973f88", "comment": "Malware payload", "value": "704f9449bff30166262f61723368d43a558292b33b0f23ae8827a606d9a82aaa483338c37de2110efeb686156e9fd741", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699564927, "uuid": "d39d9b4a-2498-40b8-9289-72a2cf3c69d5", "value": "T159A5AF23FA91C4F2C2191E307AEB57B8AAF4DEC64A208ACB9794FD7E3D71250552710D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699564927, "uuid": "c68a6dee-6b9d-474c-9821-6c390314ee39", "value": "f6135b24fee9b9624ba204728370fc81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699564927, "uuid": "a5919e93-3c49-4076-81b4-377d54d21355", "value": "24576:Ue/quPD4cS4DXb5FqGiazR8hnsNqGaFB3cQRYw9rRnChSQCQLwFwO:UGPD4ayMR8ozgp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699564927, "uuid": "e3148c5d-4f4a-43eb-94bf-f0967684a792", "value": 2121728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699564927, "uuid": "26c6a7e4-a4d6-4253-a5a7-a6590378149f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699564927, "uuid": "a98c59ae-7c2d-4f2d-956d-e7fd072aef66", "value": "SecuriteInfo.com.Win32.Evo-gen.21111.3596", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "193f7fc2-7f28-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699552069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699552069, "uuid": "b9500503-c5ba-4fd0-b7f4-40319b247548", "comment": "Malware payload", "value": "1ae06b563bdb88ccada5265f6cdee00a", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699552069, "uuid": "99d6c54b-3a3f-4348-8ec1-913fc4a2a2ff", "comment": "Malware payload", "value": "93065044d096d7846323637a2a323343eef250c5561de3a05272ae61c4ac7ba5", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699552069, "uuid": "f145f14e-8c97-4b4c-b217-c4d780970ef4", "comment": "Malware payload", "value": "a18f44824a0cfe962db1fb5da50a28948d6404ed", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699552069, "uuid": "912bb730-2e96-4df2-b5d1-79ba87bd864c", "comment": "Malware payload", "value": "a972a61db472729551284804384aa715889f4cdf794f615abd14eb2300449ce4b92604ca4171ea1d9e08d0d241df7089", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699552069, "uuid": "84ce4977-f89f-4d78-a567-64b3c899ea31", "value": "T16923C70BB2F1CE0BF56981759AF7C2D2AA36FD289FE04147B16A374D7D351B01A01726", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699552069, "uuid": "06da4c94-d2b2-4b90-9541-668050e4c48b", "value": "384:wnQQZ/ww3K4STi1pFdkkmG815QWiSAoKXMVkb0xWtCzTXXo2LPiFA6A2ECJIj:wQQZ/ww3K4STOpX812MVkgPzTXtLPse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699552069, "uuid": "c8565787-3e60-4aa3-ba68-ccdcf7f462c4", "value": 47104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699552069, "uuid": "c11d2130-8a2a-422f-9057-350744bda926", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699552069, "uuid": "591e1b8a-23ea-4e7a-8e93-48e1c8e397d5", "value": "\u0421\u0443\u043f\u0440\u043e\u0432\u0456\u0434 \u0432 \u043f\u0440\u043e\u043a\u0443\u0440\u0430\u0442_.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14eb60e0-7ecd-11ee-8907-42010a9c0042", "comment": "Malware payload (PureCrypter)", "timestamp": 1699512977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512977, "uuid": "d176103f-b445-4f80-b21e-976bbb23439b", "comment": "Malware payload (PureCrypter)", "value": "a851467f3ff09d577204033d1b78c910", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512977, "uuid": "44b50fb5-7b94-4b8e-a358-0df3cd0c35b1", "comment": "Malware payload (PureCrypter)", "value": "936b4841dddcac78a3a500e039ab213d00ffeb0f541e93fea178ff8c3b90f5ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512977, "uuid": "cae18a4f-d207-4874-bb72-0b6a956d8156", "comment": "Malware payload (PureCrypter)", "value": "5f4783c7874f30876120c631ca792cc63d95fffa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512977, "uuid": "8005ff23-bc40-4e35-9540-10fe75636c13", "comment": "Malware payload (PureCrypter)", "value": "8165fbe4209286ce1a39de8fe7ba452fed7b48cb48cc48f3da5197c687ce7d4ba636410c528489609d8b973c647f48c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512977, "uuid": "621c15c8-105f-4607-bb81-d90076a90cc8", "value": "T1D722E9D4A769DAD0C45517F9ACF78B626A79B626E8498F0F38C5720F6C032261432B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512977, "uuid": "f773b484-aa05-407f-a973-2bed52e54cfb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512977, "uuid": "03c503c6-f65c-4ec6-af6f-6826ce1696f7", "value": "192:RUvojHftRxV4dweXKzTQZfiiLX2HS9yxSyrsRt8G3mSF6zcG:RUATgdwKcKiiay9ycyrsR2vZQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699512977, "uuid": "ba3ace4c-bbf9-4d9c-afa7-62340fbee43a", "value": 10752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699512977, "uuid": "84afc847-108f-44e2-9999-29bf1236ff58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512977, "uuid": "f1c2702e-855b-4ba8-bb82-0c8aaa2a488b", "value": "Dimension.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b687e774-7f2f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699555339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699555339, "uuid": "9570a9f1-567c-41dd-b9d2-da019ee21d27", "comment": "Malware payload", "value": "20811594290c83815ae216a71224083c", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699555339, "uuid": "75eea604-125c-468f-9d0e-900101d44518", "comment": "Malware payload", "value": "9383132510c20700f3a5fda37551371e8ed03e116c290e0243b71fbc0c2f93a6", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699555339, "uuid": "b711eae3-e74b-4733-81da-0cf1a7e07682", "comment": "Malware payload", "value": "f9467b508a8a83dd6963883448872fcaf4743b94", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699555339, "uuid": "8af70c29-d49a-4bd9-99a6-438debf7b75e", "comment": "Malware payload", "value": "1acac9fac4fa6a908f2ef7dbe1051a0910716d811f58a101379a4a4e7c5d046ac1f31e5b36115574b751db5dbe9b3fa4", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699555339, "uuid": "99282cab-97c8-407c-9569-547596de76c9", "value": "T15063B05236405331C5810236956FD7E0CF6A6C899F6B5927329BB3DD2E72884B2BBFD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699555339, "uuid": "c20fa9cb-028d-4d86-b6ab-02da50802a33", "value": "768:gk27uP/OFcIy06UX7cCbUDDOxKf9LLea3rvHjMaMXeWMmCqeWMmCsK:iuP1IyUXdcDOxs97rv3eomLom5K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699555339, "uuid": "d4ad7a3e-a060-4562-9967-b098c2187bd7", "value": 69632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699555339, "uuid": "d8051705-66d4-4bce-9e65-6811657afac2", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699555339, "uuid": "60ce942e-2b25-44ac-a85a-d67ddc2f1c33", "value": "Orc-3-64251-37.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d39625f-7ef3-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699529312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699529312, "uuid": "1275eedd-03be-4a33-828e-c2e5a1f664e2", "comment": "Malware payload", "value": "28f1f5e41fe3d3d1dd8217b37dbf6317", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699529312, "uuid": "e196e643-9414-4206-873d-849c5cf892ea", "comment": "Malware payload", "value": "93aef3f0d61ec877d380bc1039f95f558b99f36bbe3ae12a2706b81dfdaa322c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699529312, "uuid": "f7fb6e73-46ea-43af-98c5-639f0c6c9347", "comment": "Malware payload", "value": "30dd900d71d5dd24373a578c0d25e96c5e631fee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699529312, "uuid": "36c5bb55-bbf0-464a-a7ec-312ef11ec2b6", "comment": "Malware payload", "value": "0e78707fc4d345d9508f129f57490994f569c0ae5e000443c8f7e4ce365e6cd43faa3c77c96612a95de9a74dec457112", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699529312, "uuid": "62701e82-75d7-4295-a145-5baf33fe452a", "value": "T129035B13DAE0C076E660DBB82D34E628F5BF3D713DB485A953A859CE1C246C718AC397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699529312, "uuid": "97f8ffa6-772f-485e-a0c3-fdf88ae6929a", "value": "012f905fbd4c16e00f39d46176b51c9a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699529312, "uuid": "28e85938-307b-4850-90c1-406239dc95d6", "value": "768:lqSwYqVQew2GkcDsUZ0puPRb9TbDvaoIjFQ04qt9l82SoXpfP/vfPBj8x:l9ZqVQbN4U2psb6Flbl825XpfP/vfPBy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699529312, "uuid": "2848353f-5f1c-4b9c-b621-45823a4b0bc5", "value": 39936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699529312, "uuid": "6b726ad1-1aa5-47bb-9a48-2c8ff4eebf8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699529312, "uuid": "cd4ddace-f015-4678-939a-6a0ec871dc1f", "value": "Bulider.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2d509a7-7ef8-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1699531711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699531711, "uuid": "cd92f298-87fd-46cf-aac5-ec51f76b3a03", "comment": "Malware payload (Smoke Loader)", "value": "f18063ec92e36ed6900335d2386155dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699531711, "uuid": "7ddf7940-2063-4d45-9eed-97b287a2e89e", "comment": "Malware payload (Smoke Loader)", "value": "940006ba7d01ed41edf4fb27a51248db71ca9173db67bd3f0904df1c0dcd2822", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699531711, "uuid": "d58f46c7-56a1-46df-a44a-4bfe201fe537", "comment": "Malware payload (Smoke Loader)", "value": "a72e0cb3fbe2b6c700fc8215b8ca5e1ac970ef1c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699531711, "uuid": "a7c1837d-4928-47b6-8786-5f5d8e8864b3", "comment": "Malware payload (Smoke Loader)", "value": "560716b811c47bd043997ad0c7763da95a7dccdab748f8db791950e0d63478ec782cc2b49e4a999d8e25dcf16a35584c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699531711, "uuid": "db81d9d1-2821-4c4f-a64a-93e38ae4a39d", "value": "T1C1F3CF2277E3C0B2D1A3613C5874DB612ABB7872277148AF37A02A3E0E717C19A75757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699531711, "uuid": "0523fcdd-765a-405a-9428-509809aee6bd", "value": "6a361b5053436377d5ca784fa78b9a07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699531711, "uuid": "66342727-6769-497d-8ad8-e715167e9cf6", "value": "3072:AwXarS1E6RU6YxT6LSRc72XZc3UOjkzdIFSaPl1iUYDqKTpU3:ZarwEaU6YxT62RciXMnjWdIMcl1iUL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699531711, "uuid": "f09588b9-ff72-44e1-a52f-b43f7263f1bd", "value": 171520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699531711, "uuid": "d2e776d1-975e-4c75-9afe-b554bfbdaea7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699531711, "uuid": "8c91f319-c3aa-4d52-83b5-bcb23df4cfc5", "value": "940006ba7d01ed41edf4fb27a51248db71ca9173db67bd3f0904df1c0dcd2822", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcb337bf-7f34-11ee-8907-42010a9c0042", "comment": "Malware payload (MysticStealer)", "timestamp": 1699557604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699557604, "uuid": "1d44d60b-7bed-4607-9849-0c2764372a98", "comment": "Malware payload (MysticStealer)", "value": "ebfa19e9059cc5c4ef302c3813610414", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699557604, "uuid": "b9c4724e-c1ea-4ef2-9b95-a18cb5d3d19a", "comment": "Malware payload (MysticStealer)", "value": "9546e7eb1ddfd2f5281bb29e6e72be43119624e185e6a3a5f62e4c13f1596b4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699557604, "uuid": "33d29257-fce1-40a9-8a4b-b64fc4277017", "comment": "Malware payload (MysticStealer)", "value": "233043b84d4df33877cc4e0b4a8bfe7a81ec6473", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699557604, "uuid": "f47d11ac-9240-46f8-9dad-9b5626ed9965", "comment": "Malware payload (MysticStealer)", "value": "3601550d9c2935b967de00abfde64cb21f7b5416746680c31597b2eefad1039131b4b16c9f5fbea4e6b5351b12158088", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699557604, "uuid": "73da82cc-df74-4066-b246-a28b526829e4", "value": "T10D74F112A7E48072E9F517B048FB02C30B36BDA19974575B2789A94F1C73288E97673F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699557604, "uuid": "1783df4c-02ec-4a32-ad09-9343c8965632", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699557604, "uuid": "0510bd17-cd1f-4314-994c-92573b762146", "value": "6144:K2y+bnr+Fp0yN90QER0ST8+kRAUXHx39ONZAQnJv8KW/4CMroSDT:SMrxy90wSTxymuQB8PAdouT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699557604, "uuid": "2fd0528c-1193-42e6-9c97-be313cec2054", "value": 338432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699557604, "uuid": "c73c0cd8-73e3-4327-8fde-a5774ddc66e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699557604, "uuid": "3ddccaa9-e5e8-4b2c-8a82-539573646cd9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3da3af27-7f55-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1699571457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699571457, "uuid": "35746c03-f015-438a-a1a3-bd1178658ea4", "comment": "Malware payload (Mirai)", "value": "db14ee7bec3b534466178c3e88f57f14", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699571457, "uuid": "317c4714-e5ed-4624-a68a-d5df7451caab", "comment": "Malware payload (Mirai)", "value": "9609f49ee4ce3ee52508d74d1c93e9ce65f3cfdb5a5c25377858fa6a54b77ffc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699571457, "uuid": "aacc81fb-21b9-4490-9354-0e13d8a2b2fe", "comment": "Malware payload (Mirai)", "value": "155568afda88d297f6077dd74de5c6624be39611", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699571457, "uuid": "5c9567b0-f373-40dc-a7b0-fba2f3e8cf56", "comment": "Malware payload (Mirai)", "value": "e7fc139c850797a393caefa2af1a9cc3b107da549784ae429cc56896fdc25416080c0bd074514061b31f0983667e0e96", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699571457, "uuid": "bdb1d03f-3b26-4b57-9a3b-d4f11babaeb8", "value": "T113639E36E41A99A4C0424634B0E5DE361FA3A9C143272D76AFE442B62403EECF55DFF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699571457, "uuid": "3152433d-c422-4d8d-990a-8affb7934273", "value": "1536:gaWbdYbmFZNwtHEpxYXvyY8/NrrPvu5eS0CrW:gv+bm/N8qzv8eS0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699571457, "uuid": "59be324a-f039-483e-bb5d-8ab8183553fa", "value": 66960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699571457, "uuid": "775e56db-9c29-4790-ac47-2b1efad3ff75", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699571457, "uuid": "5d95ea43-802e-4369-85f3-53416296d21f", "value": "db14ee7bec3b534466178c3e88f57f14", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d97d2f5-7eb6-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1699503301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699503301, "uuid": "09db15cb-9428-406e-a3a2-e4536c38ffba", "comment": "Malware payload (Formbook)", "value": "a19872861b17596822d3c0484f3b8c8f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699503301, "uuid": "5c27c204-1bb0-46e6-aabe-3e581d256b28", "comment": "Malware payload (Formbook)", "value": "9680fcf70fd9253914ccf18d134c357b91fbce01f3f5161d13d54f0ddd464872", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699503301, "uuid": "84a77efc-1100-4be8-9016-c3731696a5a4", "comment": "Malware payload (Formbook)", "value": "a0cee731dd98ea12634e0a6daa916a9d38c959b8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699503301, "uuid": "48d49a78-3ed2-4050-b86a-fbd25d2c5f73", "comment": "Malware payload (Formbook)", "value": "f95f3032a1b322f1d48bc81ae7189f77268d488214b0c87cc1d32ba153ba6f4c5164f80b3bed64cd9f246b44b80f84e7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699503301, "uuid": "2520fd71-dba6-4928-956e-be67bdd4d1b0", "value": "T129B423C96396A349CCDE4EFE00F074F06772E35716A0FB0948AD55F9AF1972D06A0993", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699503301, "uuid": "898b0b80-dfb0-4a11-ad1b-e880470e5ff3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699503301, "uuid": "18d3f574-1ebf-4b19-95c9-d3b41d8c6087", "value": "12288:nUHRbKypnzo78iUbAKoq+NYnwLJ6H2jESlZAfbc6vRuI2:UxbdJo7zC/FFySwl6fz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699503301, "uuid": "a1cfde69-a063-46df-9207-3a62fb98de09", "value": 539648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699503301, "uuid": "272dabd0-a187-4610-b55e-c63a5b9fd32b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699503301, "uuid": "754c2c7c-ce1a-477e-be25-f630fda70ba0", "value": "a19872861b17596822d3c0484f3b8c8f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ea8b600-7f30-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699555648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699555648, "uuid": "6b5a893b-1011-4875-bba7-155e5522e050", "comment": "Malware payload", "value": "af13a884c5d26436686ec67e3950ca00", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699555648, "uuid": "3ab1ab69-d984-4c36-8f21-420c596e8848", "comment": "Malware payload", "value": "96eee4f2533216ed17187439a80704beb001458772a51253a00c385605f7caed", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699555648, "uuid": "5c1e0b08-6d7f-46e0-942a-7a9a2ac6c79f", "comment": "Malware payload", "value": "1ae6478b4177586fa3094f8facae0c041b801e74", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699555648, "uuid": "4d2b7942-e62d-4a9a-b721-98ec742a6097", "comment": "Malware payload", "value": "24f76eca75723145304dd5a1b43783b4b3033c15cfbde6ac5b57a6b7ea261adb6b065beb287d292502c98ca56d9888b7", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699555648, "uuid": "dd9aa35c-9f32-480d-893b-d2ab3b507686", "value": "T13113F22703333D7A55036EFD2455B1B66000396AAE386A9E34A5D9FC72E219EC7CF054", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699555648, "uuid": "ce9ce77b-74ef-4bb4-a4fb-aa7a2125bb75", "value": "768:fTmtfYEKVKLlmvK6FhunB9Brk9sNiK8GYsXLJUyXg98ZAYi6v8IG2egg:fTmtfn8gEvpFhMRR66aQg98ZF0IG2egg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699555648, "uuid": "09969e57-26bb-42ee-9051-9fe0664801a2", "value": 43752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699555648, "uuid": "6fa20237-9d3e-472f-b82a-750222eafe9d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699555648, "uuid": "23f92023-a4cc-4047-9c01-5aa6644a300e", "value": "Orc-3-64251-37.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22526e0b-7ee2-11ee-8907-42010a9c0042", "comment": "Malware payload (MysticStealer)", "timestamp": 1699522019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699522019, "uuid": "561a98d6-64c8-4689-9f6e-3580b4e0d48b", "comment": "Malware payload (MysticStealer)", "value": "15f94ffc3bbb605ec93596b430ae87fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699522019, "uuid": "6e9b7d7c-9bb2-4699-9407-7f3db4b3b3f4", "comment": "Malware payload (MysticStealer)", "value": "973b64558e9e2aa179454c438a0d769ed89b7e8625f03cc00c6de8bf9cb9563e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699522019, "uuid": "bd69e39a-9b7f-44bf-ab00-936b66ab2dbf", "comment": "Malware payload (MysticStealer)", "value": "54a22efbbef477ffac300ab2cec97214578472b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699522019, "uuid": "d8282bcd-7893-4d90-88a3-560ebd61a70c", "comment": "Malware payload (MysticStealer)", "value": "e5036b1c4e229013af83e5e94debeb8669ef262e26c30e5d1336d8c54fcd5c198e4659e84c9ccf676d7e684e26cc8bf8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699522019, "uuid": "46b020e7-745f-4ce1-ac9e-c419bde23fb2", "value": "T13B64F143E7D88032EDB117B058FA06C31B31BDA29D78926B33459D5A4CB26D4E5B633B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699522019, "uuid": "1138d3da-603f-4fe9-aa29-600b240773d4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699522019, "uuid": "db985904-67c3-46b5-9f68-cb8c1860f44a", "value": "6144:Kjy+bnr+5p0yN90QEXn8AOhkhwauqFnn8deULVriUTnnw:lMrBy90B8vhkhfuqRKe0Tnw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699522019, "uuid": "f312b43e-0b46-4dfd-8378-acff5cd32074", "value": 331264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699522019, "uuid": "68522b33-4577-4363-97d5-5f5466cd9d1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699522019, "uuid": "de3fa62a-7bf3-4205-a051-8bb6857756a8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "732cc0ca-7f50-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699569400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699569400, "uuid": "bea7013d-c005-425b-a0c5-1b3bebabbac1", "comment": "Malware payload", "value": "2c1702ec1ce5fce93e682e82afe6fd91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699569400, "uuid": "07772631-be85-4057-b42c-61171ea31492", "comment": "Malware payload", "value": "974c305c041b850912060ae637ec1fc4a89c83286ebe2535df60036e02556627", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699569400, "uuid": "717dcd61-6268-4a71-90f9-0268952c1bda", "comment": "Malware payload", "value": "d24ebe256b5be80fccded7a1259b0c83a7c2748c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699569400, "uuid": "fd3b53e6-7445-49d1-815a-5d88a80702d3", "comment": "Malware payload", "value": "50eed2eea91e0e55e502ab9d4d2ea4209bce18d7132e5063c560d45b615d6da63af72032dc5ab2346e351b337a861ec3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699569400, "uuid": "d4d4e06a-96f9-45bb-9cd6-66f5c17cf940", "value": "T106B40226EBE89032DDB523B019F702C31B397CA1E83893AF2785695B0C736949536777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699569400, "uuid": "9a3a42bc-ab0a-40e1-a726-8fe9052ed50a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699569400, "uuid": "1ad1bb2d-9137-427d-ac92-d0e5e46fe607", "value": "12288:wMrhy90SyZFroFxDFehD9iSY8TUs2vue+4+wSRnFds8aYni3z:ByDKJ6FehDMSYSz2vu5US5Loz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699569400, "uuid": "61113db9-107d-4ff0-8c4d-90f49f2d9b81", "value": 523264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699569400, "uuid": "c35ae488-45d1-47a0-9f7d-caa2705cfe35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699569400, "uuid": "f8462e12-f3e1-4489-adb2-957cd2705623", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22e5ecad-7f1a-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1699546072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699546072, "uuid": "375bb224-0551-40bc-a057-f8e24d353a29", "comment": "Malware payload (Formbook)", "value": "a0258c23abef8d065c822647f613eae8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699546072, "uuid": "9e443298-ca16-4f30-9824-113421cdd1ca", "comment": "Malware payload (Formbook)", "value": "97aa1f7a3120159c1714199bbcec347d06cc9a18236f62dd22c315bb7362509d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699546072, "uuid": "9f3ef037-ef5c-445b-a2e5-418427308e29", "comment": "Malware payload (Formbook)", "value": "87113ab05eed9306f59d666a251291ccb96efad7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699546072, "uuid": "e1f5b18f-3e02-463a-826f-b3ce5dc9d275", "comment": "Malware payload (Formbook)", "value": "d572fc31f93d1f3ba06ed66ced8cbe219c5cfedd7487b56fcee7f628de0770c3d6d463d668f62b15f59d1a54d6a1d4e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699546072, "uuid": "cb993ca5-0842-4115-a731-d6a357c482e3", "value": "T1DDC42395BBE10897E4C85F350FB2CB15D97AC520D930A68767A52E711D3620A3F2B4F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699546072, "uuid": "0ed5a211-26a2-476d-9811-0ac440c8bf09", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699546072, "uuid": "a69ba27a-78ef-458e-8fd8-979922761d27", "value": "12288:o3vUTE9KxxtZWrOy7WBsIhz5PXnyxRTUuZTAJgxCZ0FMuVKoaW8M7:uvUTEax/SO2W5PX4xZMgk/mV7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699546072, "uuid": "5ac4220d-57d6-43d8-8c22-f22ed9b909ca", "value": 590362, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699546072, "uuid": "b36dccad-c5b5-4469-aa2a-3abbde03feb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699546072, "uuid": "67c71cbe-cbd6-490e-8626-95ccf432b33e", "value": "PROFORMA INVOICE-CHEMTERA-LTD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bc100b6-7efc-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699533229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699533229, "uuid": "242601dc-31bc-4ca0-834a-ff28d535265c", "comment": "Malware payload", "value": "8e429ef64bd3d17aa8d4e9af209ff6b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699533229, "uuid": "c1393a87-d642-4685-ab35-3fe874ce09c6", "comment": "Malware payload", "value": "9857a0b39875c74c8a13bf410ac130ee17f9ca59e40561087c26053da947b5e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699533229, "uuid": "71e5ed00-d9f4-4fd0-969b-2c7ef075562e", "comment": "Malware payload", "value": "3a6ad8f97c820c3bc48f75b4845b8dd0179d3d0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699533229, "uuid": "ad269870-d3c9-41ff-afa1-0e7b16019ea4", "comment": "Malware payload", "value": "c1b97f0da23d66ee61650ef8e6c90341282bd7d19acfb3bde0420f48cf7d89c0cb92e7d8a90b7efa9ca3ac255f6ea831", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699533229, "uuid": "10970595-2996-46a6-bcce-55cd7f2ccf97", "value": "T15824DBE0317D93CFD1A28DB11FC98AB079F135AC98C4160DA0F69B2E93D6395189C5FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699533229, "uuid": "5b45f043-3c92-453f-b87a-3bc42442709a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699533229, "uuid": "16fd04a1-4039-41b8-8574-dc925dabe815", "value": "1536:+U9UPqKoUMHCSAY1c9wqvnAv77vvvvv7vvvvvvv7vvvvv64+mhhhm+DtqOgAZmJk:+sUMHCW+9wqY+mhhhmitqO8SfxvPXj5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699533229, "uuid": "15d27350-3c6b-4246-a7f5-8744a24c1870", "value": 219712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699533229, "uuid": "ad066379-c539-4654-a207-c9c911de04f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699533229, "uuid": "12331ec8-d4c9-472e-9beb-a2223f63998d", "value": "9857a0b39875c74c8a13bf410ac130ee17f9ca59e40561087c26053da947b5e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22e63f33-7f3d-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1699561105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699561105, "uuid": "a9ce8c63-dd70-48ef-86a1-7ad22d44b96e", "comment": "Malware payload (Stealc)", "value": "a593e9637b78f6217527e7e068eac0a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699561105, "uuid": "8bf9b549-e929-4ca0-881a-0fb62a78d209", "comment": "Malware payload (Stealc)", "value": "9874344a99decc1e992247d55af62d3a4816cd0ca4c2dbb5a7b6b1cff9436386", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699561105, "uuid": "6e88f5ce-07dd-4276-bc38-60079d2b525d", "comment": "Malware payload (Stealc)", "value": "058df2f8bc3db6b144dec3ea155740fcf5508756", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699561105, "uuid": "946bc61d-a448-4f87-8329-60b845b2e763", "comment": "Malware payload (Stealc)", "value": "49027fa62a778547b28128ee6729035640752b5f8ae0588afe43f4f5c397b0344fd1f15aae4fa97e5f12638fab2811e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699561105, "uuid": "d158e051-397d-4fe8-bf5c-08b0c56918c7", "value": "T169444B13D2E16C7AE5334E328E6AC6F8261EF9618F15379A16F5EA2F09701F2D172311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699561105, "uuid": "ade902e6-201d-49d6-9497-b66cb67865a1", "value": "3cd79b5b1120e33d77de0a8be20f16dd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699561105, "uuid": "052375c4-4cff-4aa8-a68d-11d9cc29ca36", "value": "3072:Lv4EN1J4hj/EcjoMKz2xioU8PwzYcJiXxv1UPCFeOyn:Lz1J4hL3oMAA8zHiXjp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699561105, "uuid": "2eef016f-f3fc-45cf-88b5-44e6371d8577", "value": 266752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699561105, "uuid": "4b4f398c-0587-4117-abca-95e7f6ca95e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699561105, "uuid": "664be974-653b-4041-899f-f8dfbbb4ceae", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "058a8a6b-7f46-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699564921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699564921, "uuid": "1ec8e2ac-156b-4b01-bda6-7eb53feede25", "comment": "Malware payload", "value": "b1452cd238cc2cd18e1b323c012ef128", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699564921, "uuid": "cfc79c62-59aa-4cd5-a4e8-31e43e82b869", "comment": "Malware payload", "value": "98f642439415733e3a491eb90ab4b9e57b27c31b7b0a3137d9f64c0c5c6abaf6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699564921, "uuid": "266fbf31-fde7-464d-93e9-adf628ebd1d6", "comment": "Malware payload", "value": "d4f4f939e7b0e561a3157d65e4bdf1a19b6385a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699564921, "uuid": "6555ff6f-6171-44d5-8a6b-ccb28f35d397", "comment": "Malware payload", "value": "48ec11c049c950c47c1e554aef65320a4f0447193db4eccf255596edbedb946c9d6464828dddb1a9ad6e1882dff3b367", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699564921, "uuid": "6422ce87-cc69-4e8b-bca9-cd18c1852ccf", "value": "T1A8D48D11B9E290F2C61655F0086BABB6AA75AE024B11CBC7D394FE1E3D3F1C096371B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699564921, "uuid": "42a0f33d-537b-41c5-849f-1a33b2497a71", "value": "2be871a27437dba2c486c2cdc5241de9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699564921, "uuid": "51e4b115-ef8c-4ae1-868f-ad5e38846e53", "value": "6144:vnOMuKGkZ8aJuCE8yY68foep/UKVUJhpEP4sAcYKxYn5phhfOdmXrZRDNT/wzcTe:vjDGwbuRuxfoep/zCfcyn5zHrBm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699564921, "uuid": "1199f92f-914e-4635-bd96-ff2360cc183c", "value": 655360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699564921, "uuid": "3dc78aeb-16f6-427d-a1de-9782540d2812", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699564921, "uuid": "7b9c0424-81c4-40dd-9458-2afc56688749", "value": "SecuriteInfo.com.FileRepMalware.29312.1052", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee78296f-7ec7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699510765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699510765, "uuid": "09319e6a-a0c0-4416-87eb-d25174baa6da", "comment": "Malware payload", "value": "1c966181d6bdcf918f48c225623da661", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699510765, "uuid": "d904d879-6204-49e9-be54-c32dd5f08ec5", "comment": "Malware payload", "value": "9a2c9ee40666c0fe192abba3d2b28dff37e53c3e4743d32b74c115c874fc0c41", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699510765, "uuid": "dbb72143-a409-43fd-a457-fa39d84ef1f6", "comment": "Malware payload", "value": "25301ea47cf1e2e6cc2a7769800adbc90f420d6b", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699510765, "uuid": "fc1fcaf8-1e17-47ea-878d-f522f7842dd5", "comment": "Malware payload", "value": "88a2cdf04e95e511608b0bb62cb14853ddb217c0df04d4375d0663eaea7108726847a42353b2fdcf8676c3669bae760a", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699510765, "uuid": "884a1b84-e47f-4e8a-8c5c-d3ed6c3bfbad", "value": "T126252300FAE91F0FDB1956BD558B8E2A205AFF4E0B04B0FF6794B9CA113FB215497825", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699510765, "uuid": "984aebe8-2fa1-4720-bb5f-90f64250b1cd", "value": "24576:xPclTR9ZPAWDOL14zXIQx/OOIQ9H+NDF:y9P6mn/9H+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699510765, "uuid": "b54b614a-d1cf-4f41-9583-2e10adf73cf0", "value": 963072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699510765, "uuid": "5331c8c0-5cd9-4147-9f1b-d9bae40ecabc", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699510765, "uuid": "67026c90-13df-442b-9a56-c7a05851d093", "value": "SecuriteInfo.com.Exploit.CVE-2017-11882.123.29122.26230", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26878c25-7f10-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699541783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699541783, "uuid": "1c6e9d77-fd1c-41c5-9694-0f8149355a75", "comment": "Malware payload", "value": "9b0827170a1fbdec65386593707651ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699541783, "uuid": "a10e0ea1-b19c-44ec-a220-dbbd3adc7342", "comment": "Malware payload", "value": "9b35e4bb82b36c81a064b1178f38926f82b767ccd07b0838be536876b56bc852", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699541783, "uuid": "fffdb507-5877-4ff4-a8ae-88db2c01dc4e", "comment": "Malware payload", "value": "e7566db138ae3702a2cb0d0639957925b30fa926", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699541783, "uuid": "3151c39d-8e51-4aea-926e-4f2d6f805e51", "comment": "Malware payload", "value": "adf2485c6cd279c72228a9c4730d4ebeebfb259593f71cc7ec29ee3c824bdebedb10a4425139356964ae4acce9750bba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699541783, "uuid": "c162f3b6-e59a-4f2f-8bf3-5180fda82eb3", "value": "T190467E07FAA244E9D9ADC878835FE123EB25B8494111B62B7BD45F103F26F20AF4D752", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699541783, "uuid": "e648e667-3e07-4c67-b9e3-400cbdc6f79e", "value": "98304:6eCV9f2F1wEuAQlthlll1llllKfu8ogWc+u+x:L1vnmBglBi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699541783, "uuid": "eff30673-7136-418b-aafd-8577f92277a2", "value": 5817568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699541783, "uuid": "d49d39dd-e983-4b88-894a-18063511c257", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699541783, "uuid": "a10e7921-a098-49e6-8565-2d4054fdfd89", "value": "linux", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b79f2ff-7ebc-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699505902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699505902, "uuid": "4540ce83-8c70-43af-8824-89ed9afa930a", "comment": "Malware payload (AgentTesla)", "value": "93f252a044f077c268e1f7811dbeb206", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699505902, "uuid": "c00e65d4-f138-4cbd-8bcd-e862fe466e00", "comment": "Malware payload (AgentTesla)", "value": "9b79ff9010594bbf3c2fba2b70d9a50dcca2a9a88090112ad0e1755ae2fc3823", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699505902, "uuid": "b6e6d7aa-703b-466f-b341-f8b09020b6f7", "comment": "Malware payload (AgentTesla)", "value": "31df7f3f7ec9f3df32dbd1afe55004fbaaae0c99", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699505902, "uuid": "6eb18cb8-7565-4c10-b509-b0f17c54cdcf", "comment": "Malware payload (AgentTesla)", "value": "5560e241a475f5023f09edd687e4a43e2e12b88f4eada1561540ae49553a4040f10164a3bc51a0993cd7f2a8c1a6a491", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699505902, "uuid": "9580b1aa-2515-4f3a-83ee-368684865291", "value": "T14DC423AD17F292BFC6CC1F764872694047B0D7674813EB042CB8B59A7675F5809A0EB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699505902, "uuid": "1ef05094-8058-41b2-bd33-a6c1c7acd82b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699505902, "uuid": "18db54bc-ae03-4b77-b95a-742f5ef433df", "value": "12288:+8oRx/WvprlcO33HtC07OHDzgawJYATAurKJ0pEij7+nwqtwRv11iro:NS5GpJcOHNHozgaqbvKEt3+nIRv11Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699505902, "uuid": "c684fa2e-29a2-4e7f-9fe9-2ab555a532e3", "value": 595968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699505902, "uuid": "d5573ab8-b614-4414-8ac5-4b406ddb6f0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699505902, "uuid": "42031ed8-97a9-43e8-b604-7155470105de", "value": "93f252a044f077c268e1f7811dbeb206", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9146859a-7efb-11ee-8907-42010a9c0042", "comment": "Malware payload (Loki)", "timestamp": 1699532943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699532943, "uuid": "a7ad26c2-e52e-4b81-878a-61079061d6de", "comment": "Malware payload (Loki)", "value": "f6e8710e6461170acd76edda04879610", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699532943, "uuid": "0e57f9a1-c3a9-40e4-bd34-cce238fba04e", "comment": "Malware payload (Loki)", "value": "9c12fc0d2dd8391d915ad8de7ed3212f6251220133b79d66aa89490ea290eaa7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699532943, "uuid": "987d3491-202b-4c70-be48-0e01a7c0be9d", "comment": "Malware payload (Loki)", "value": "b5ac12c0ad9d3a39fbe57b173b8dea45076ca627", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699532943, "uuid": "0964ee84-042f-4bc4-9210-17d892fe9908", "comment": "Malware payload (Loki)", "value": "fbee31bca13ccdb932be7f18ecadbc10f3160c22d1ddfe260bf7c521df47f27433b15229ca4d1c779bea55194a6f4e63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699532943, "uuid": "3ab4e920-e3a8-4dc0-a121-d266f1766d1e", "value": "T155949D28F2B46B5FE5C64536CD606BE0627268133A13EB6BCC50E589381DBD38AC15F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699532943, "uuid": "ab410f20-c7d5-40b6-b68c-761d6fceaf72", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699532943, "uuid": "a2f7a51d-c541-47ea-95dc-839e60caa08a", "value": "6144:GE+yuRS7UQ4NI8jv6DWM5jWT1+vZOZ2+NM33mkJVqWDe2IuShl:GE+yu9NIsiHjWT1K4Z273mUe2LShl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699532943, "uuid": "66569b34-f941-4b9b-9147-8baa4049d594", "value": 436632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699532943, "uuid": "c53fd706-30d4-49a4-8769-79c1149c29bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699532943, "uuid": "22829a7d-f152-40f6-953f-3ed74589ce68", "value": "#SBPO2311-006.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f99671f-7f4b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699567273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699567273, "uuid": "3ea0e1fd-1b38-4dba-bd46-22865edd872c", "comment": "Malware payload", "value": "8414dbcbe2a4dfaefef916d89f768521", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699567273, "uuid": "84ca2de2-359f-402f-b713-00d7583d8080", "comment": "Malware payload", "value": "9e131443da3d2d4635d775fbdae90194f23257de4c562dedd7e2fdc0db95f79f", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699567273, "uuid": "a7c66a31-1201-424e-9cd1-38baeddd64bb", "comment": "Malware payload", "value": "693e0ac09b79fe671abe90a493076fb5b4ed5438", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699567273, "uuid": "d71d8af3-272e-4035-abce-af31fe4e835a", "comment": "Malware payload", "value": "af843dd67d59a7f62ad947d5fd128c4e6734d725e7155a081dd1a87c9198fda015e8cf1f17ac5bde66f7c4af36234c11", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699567273, "uuid": "d5ba0494-465f-4b0c-9b0c-87172bf4e889", "value": "T1FA51CC222FF50A28F7B74B396876772096BBB815DA158B8E415142080822625D478F6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699567273, "uuid": "263aae99-3972-4938-a697-069d0c67d259", "value": "48:8hGCphNtodIn7dyJKSdJ9lDDrakhfX0r:8hppzbnAgmfDDrV5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699567273, "uuid": "e28185d9-1c48-4ebf-a221-904e881b0a58", "value": 2475, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699567273, "uuid": "63efde73-2436-452a-93c0-3b715203706c", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699567273, "uuid": "b0044f66-3ae7-43c7-829c-e010e7cf9fd2", "value": "Microsoft Edge.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05907fbe-7f10-11ee-8907-42010a9c0042", "comment": "Malware payload (Pikabot)", "timestamp": 1699541728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699541728, "uuid": "38d17d7a-29ad-4d7e-880f-9337b80ae836", "comment": "Malware payload (Pikabot)", "value": "8a879cbd93200491381361b883554bab", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699541728, "uuid": "e3d7ae63-708b-4931-b8e3-4fdf4c5210c4", "comment": "Malware payload (Pikabot)", "value": "9eacc3ce2e263cffd5034c3592bc6dccce5f6b46bef417fadba55490b8791429", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699541728, "uuid": "1075dc51-5159-42b8-af34-a811782895dd", "comment": "Malware payload (Pikabot)", "value": "164591b3993b565a4d3e8a2635dcb78cc4a3be12", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699541728, "uuid": "6c49d1ec-d5ac-4e9d-a50b-a527442bacc6", "comment": "Malware payload (Pikabot)", "value": "48cdb46f16bf6edf4bbdfee7b27a4749dd38d5a50a0b52202d984995844cd9e87d9927ede660cf4fd1bb8b0ec083c324", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699541728, "uuid": "749c897d-16d9-4241-be6f-60102a4e995d", "value": "T17DC5D003BB8259B1E5CE067961B66B7F4E3A9610D324C9D3CBA12DA5CC312D1673E38D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699541728, "uuid": "95993844-c4e0-4496-a77e-5a0966266851", "value": "f25ba11cc2f9d886b0989a9c392d11cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699541728, "uuid": "5083dc8e-bf25-4caa-9bf9-9e6ac9e12145", "value": "49152:921mU+j4kNwzaKPvghxk1CPwDv3uFmAVpzCTJueu+FNRdonOMyDWCEjGmH9g:9218wzakgDk1CPwDv3uFmAVpzybFNRKM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699541728, "uuid": "78b4e4f2-0637-4c3a-ba4f-c6a1110368ff", "value": 2615808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699541728, "uuid": "bb784df2-7a5c-4f0f-a3b7-073b39264d32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699541728, "uuid": "33da4763-fc93-4f18-a53b-3883be8ada55", "value": "Nonempathically.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33256918-7f0f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699541375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699541375, "uuid": "09b08c2d-3942-4959-9c31-28f6e20f1954", "comment": "Malware payload", "value": "6ae8fa674c4b985563bbc09c76cf24a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699541375, "uuid": "81a45f9d-988e-424a-9fb8-5c930383a4a1", "comment": "Malware payload", "value": "9ec9d3f720a752b9ab928e1c395c778d3da652442d0f0ae09552efc2f57ee6de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699541375, "uuid": "229a6fa3-4506-44bf-9801-28699a4c0134", "comment": "Malware payload", "value": "fd9729bcc93bd0a8abd17ed5a4b0f7a09e6455d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699541375, "uuid": "b788ce2b-7fd6-40fa-9a76-7cacad3f0ad2", "comment": "Malware payload", "value": "0c84c09206889c6cfb56e6f7715147aa7a3063e3b1789aae49993599f717d95f98018a33c8a20c1973a32b717e3150d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699541375, "uuid": "2f9be162-753b-430e-8428-004d89c7970f", "value": "T1AFB533E019DC8F86625FF70636A9BF6388907BA35AD53CD00B21E285477E0C62349ED7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699541375, "uuid": "fb7f3665-22bb-4a69-a629-33de41830fe8", "value": "49152:UhnZvTzEh9iKTZBn50d3i3QhqXE84MPV8IfgK2QPUfh/5JYMLG:ULEjxTDek39ZiIoK2QPWh/56", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699541375, "uuid": "c891dade-e0f3-4778-ae05-f67f7ba56b48", "value": 2386472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699541375, "uuid": "87648d59-f756-4419-b3b9-ef466848cd7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699541375, "uuid": "748a464b-c0c5-4b1a-a680-01f5e1f23073", "value": "linux", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16e8db92-7efd-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1699533597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699533597, "uuid": "554012df-73dc-4106-bca7-ed5a6c9c5f5c", "comment": "Malware payload (SnakeKeylogger)", "value": "85443ccfa143379ec25bb88f633b52f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699533597, "uuid": "21842d7f-9b47-44dc-82c1-4c65eae501f3", "comment": "Malware payload (SnakeKeylogger)", "value": "9effb24088b93de7e99f6e33a9e81b4d7bef01720107e634b98c2774fd913744", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699533597, "uuid": "db0bca39-3791-4654-a3ff-1ca7181de378", "comment": "Malware payload (SnakeKeylogger)", "value": "54d38cb1493d74f5db941457134dab70e6adba6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699533597, "uuid": "25e4ef2d-4619-4e04-9eca-884130a49635", "comment": "Malware payload (SnakeKeylogger)", "value": "3f7c99a630e4723248c197f7b579fe49fdcafc3dd34297412476f897dd8523cc087673efb1a20a2ad8f6e8ab19b80026", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699533597, "uuid": "9b8bffe1-9757-43cc-8837-2d4eb2fe1df5", "value": "T113B4121597EC5B02D9BE57B52471A2159371E80B1A63E32A4CC8A2F77733B848BC5BC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699533597, "uuid": "48d862ca-e11d-47f0-b17c-2c147571c3a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699533597, "uuid": "0f5715e7-730a-4f91-9476-54db5cab1694", "value": "12288:GyEYyVFliq4zzbTA23nSbFHGyWFhhassVGaW90QDZmcI+vy:nV+FliBb73nSbFIKsskF0QkcVK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699533597, "uuid": "68c3a322-e734-4990-991e-fe8bb2afa39c", "value": 536576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699533597, "uuid": "65df896b-ea64-45b6-8ec6-1b67130987ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699533597, "uuid": "b536e83a-c848-45d6-84c7-84e77341e8d5", "value": "9effb24088b93de7e99f6e33a9e81b4d7bef01720107e634b98c2774fd913744", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1342a6de-7ecd-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699512975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512975, "uuid": "a6781e13-356a-473b-91d8-5b12ea2fe557", "comment": "Malware payload", "value": "52033d83ad26b727153a1f3ca9c2526a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512975, "uuid": "550ee3b4-c925-4728-9d5c-3bafa4bfabef", "comment": "Malware payload", "value": "9f9607f15a598ed9a5c0c46358787ad20937f1c3ad4c09e4451bebe2f21d668e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512975, "uuid": "79f588c0-3d41-4990-8e73-b1d912e8eb00", "comment": "Malware payload", "value": "04b475a45e0472041626422a70b41f0f274e88e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512975, "uuid": "b38f14ce-72fb-41ab-9dd4-8d03a38358dc", "comment": "Malware payload", "value": "d40bafddb4dc7186ea8ce2a76869703137b1555c414a01084eac8b9566f4e76667c933122664a26c154ef71b0e4839af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512975, "uuid": "b65ffc6e-ac29-417e-b7e0-ae12970fb1d6", "value": "T1B5136A0C7BAC3911C2BC347DD9E75A1413B461E3B602EE5BFEC564292E87BE2A511B43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512975, "uuid": "4ab59325-2aed-4efb-b996-6f857841b2da", "value": "768:F23rW/JptUt/hYHqxt4m2OBvtXKU1ibFLCCnhI5FjzaAycyrsR2vZ3:A3rAUfYKf2OBvtX3oBCChaFyXvvp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699512975, "uuid": "70c89ba2-d158-4a7c-ac9c-8e9d5c1512c2", "value": 41472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699512975, "uuid": "db8f89e7-d123-440b-aa89-2493035f01b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512975, "uuid": "c1543f91-c0a4-4c12-bd21-8cd24bfd7d66", "value": "weight and artwork.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b843a3b-7f26-11ee-8907-42010a9c0042", "comment": "Malware payload (MarsStealer)", "timestamp": 1699551428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699551428, "uuid": "58c90f34-e4a3-4562-8340-6c9c1ea807e0", "comment": "Malware payload (MarsStealer)", "value": "828cde085073cc56811d1521d4d63649", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699551428, "uuid": "9a38928d-9f49-4cdb-a659-80408ebb2c67", "comment": "Malware payload (MarsStealer)", "value": "9fb3f3d6f9308bef12c594d63384211b5df353e5121fd2a1f80888ccb6410fef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699551428, "uuid": "6f6a3828-49a2-4d31-bb5f-dde590a3fdcb", "comment": "Malware payload (MarsStealer)", "value": "d1abe38b0f16936eb2c92de814f9ee3d05829c37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699551428, "uuid": "24cee560-2fd3-480a-974f-eb9d02838bc1", "comment": "Malware payload (MarsStealer)", "value": "8cee0ec5d306520ba941cf097bfb58ac6c93e3fa2d012fb14add0130aae221a0299cbf6ebe4d5de4d2c429f4c87d77c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699551428, "uuid": "bf6ed4d0-303a-4b9a-ab91-b7f2efa43133", "value": "T1F2258F11A2C48D3FD17B393CAD2BA2659D297E0135B8D4867FE46ECC4F312827A74693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699551428, "uuid": "d9a9bf47-754d-4dd2-9543-593e139dd5e4", "value": "314f76b76c3c58310552ceafbe448443", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699551428, "uuid": "f8282151-b852-4019-ab2d-030dc1603bad", "value": "24576:cUuCGvy7Ht1JRrm8UUx4iQ99DnocClngO0ZMIlqjyn9:t3ZMKgO1IlqW9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699551428, "uuid": "68db7e82-3ea2-4cb9-8498-4c7131a17579", "value": 994168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699551428, "uuid": "6b53dc3a-7c3e-4227-8db5-7a81ea92ef9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699551428, "uuid": "ec161a2c-9746-4bbd-a306-7b16219594a3", "value": "msvcsc.exe.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e9be7a5-7ef9-11ee-8907-42010a9c0042", "comment": "Malware payload (DCRat)", "timestamp": 1699531972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699531972, "uuid": "7aaea472-b75b-4dfb-9c8c-c39f5d2eff95", "comment": "Malware payload (DCRat)", "value": "2bd2d6a255e627a8465fd8521dd65a7f", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699531972, "uuid": "d6d0ac1e-c399-4dac-a83b-0fd4fc9e2010", "comment": "Malware payload (DCRat)", "value": "9fe02aaada149d3806300b2e860386533ef371df36842c212e2483642086dd37", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699531972, "uuid": "e69a743a-812a-4d42-b2ea-c9082f083683", "comment": "Malware payload (DCRat)", "value": "4b5915b32f7645652c1132a33175782dd9e3c354", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699531972, "uuid": "b8606ca5-8786-433d-9d10-41bdf236e2a8", "comment": "Malware payload (DCRat)", "value": "f5b8d98d2becb287c1e7ffec0c1505ee84f3e02716d6234ddcc10c523dd5aec43c6fcf7a863030bbecc0339c7b9fc5db", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699531972, "uuid": "9d73de99-bcc8-4538-be51-8bfeb36fba5e", "value": "T1FDA5BE027E44CE16F0091233D2FF454887B4A9556AA6E32B7DBA377E65123A77C0C9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699531972, "uuid": "f69b5122-225a-4490-9aaf-b71bc4d42a75", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699531972, "uuid": "3bf0cd5a-9efb-4f17-88ba-573be4ffb518", "value": "49152:dpEYPUUpXKs7cnhyvc16K7bV9+UpbCpR2aAY:dpEYcOT7chwqB7bCpRJA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699531972, "uuid": "7848a5c7-ea54-4d9f-a412-ab7f85460c23", "value": 2112000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699531972, "uuid": "c2512c54-fadb-40d2-9932-02edd4c34907", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699531972, "uuid": "d3d41e2c-b584-4142-9115-f821bf2b3eda", "value": "9fe02aaada149d3806300b2e860386533ef371df36842c212e2483642086dd37", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a11d6df6-7f47-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699565611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699565611, "uuid": "e6feba7a-3d26-4000-babd-c11d4a158fb6", "comment": "Malware payload", "value": "2d07618c96108ad7a16ceec8c5278384", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699565611, "uuid": "f66263fe-c94b-4eef-85a7-8558e6670a87", "comment": "Malware payload", "value": "a17da745597bd2b7d664813c5d59212ab7c63ebdfcaf880576deb4be6d981f4f", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699565611, "uuid": "50f94214-f927-4919-ac82-be9fa4b08aa1", "comment": "Malware payload", "value": "79c77719a89bbbf450507239fae29e38c3dcdd4c", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699565611, "uuid": "1823009b-6c08-4c3c-8d09-26f122e99673", "comment": "Malware payload", "value": "191b9fc15d02a3933beeb952dbd63f55e39aa282a1607e517676a79b0ad537bb4a70c31b52c0ce6067afd875d74e2a47", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699565611, "uuid": "0c65a925-ab4a-4f87-b65f-f818b62fc2cd", "value": "T1BEA51247BB868EB1C2841B7AC6DF21044771D392B7A7D71BB98E23EA19033BB9D44507", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699565611, "uuid": "3eb46b16-338e-40d4-9f00-5dca186f931e", "value": "49152:6MQtuFJQZLHueXpIqk4uTlrRnwrmd+abXgW5BHTPR:6dULepxkzZRCs+akWDTPR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699565611, "uuid": "0f162745-50fc-4706-81af-1700228ca848", "value": 2208768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699565611, "uuid": "e60b49b8-9e2f-4504-ab41-b64e4e3cbb59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699565611, "uuid": "db4175f9-e2b3-43ba-91e1-0ef34550e98f", "value": "2d07618c96108ad7a16ceec8c5278384", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b43331a1-7f5b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699574233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699574233, "uuid": "ea492c77-d55a-4b95-aa9c-7c469c0abc6d", "comment": "Malware payload", "value": "c6ade3d9e2db8c7d7b19f89f0cf2c952", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699574233, "uuid": "af823683-e6fa-48f9-8f40-8fa20356ad7b", "comment": "Malware payload", "value": "a209da8c24f919843910c03ef66c266f6b8e466812e9a7789c13e0813eed733c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699574233, "uuid": "000a0fc7-502e-461f-b2f5-25f6d5874055", "comment": "Malware payload", "value": "9739a68dcd333cf09ee2b95dee7a9072aaca87b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699574233, "uuid": "bd72222f-fe76-4d42-8e89-77c7e01d9611", "comment": "Malware payload", "value": "47757f29a720c2b8de10552a4c7c8513bc7486ecd6eaede26bb99e2b6570f2c681f1badabe909a3ef5efe2b9082f01bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699574233, "uuid": "84c3ff04-d34b-4e1a-994b-2b594d231ac0", "value": "T11EB40252BBE8D0B1EDB157B018FA03D30E397CA19978822B3745A85F0D736C8667176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699574233, "uuid": "b9edbe1b-9f09-43e3-ad6e-0694058295b3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699574233, "uuid": "fce983f7-d7b3-4538-a93d-e6681c7b34c9", "value": "12288:DMr/y907O5gHxZw2zsTyY8TUs2Cux+4+wSRcFntGiGTC3f:IyqO5gvYSz2CuEUSaKiGOv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699574233, "uuid": "02e63b88-3264-4354-be4c-de57bf6a4097", "value": 523264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699574233, "uuid": "ed88e042-9f24-4090-8a91-3e1c19d9a8d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699574233, "uuid": "9f9367b4-b1c0-41f2-b449-d202a2c8c0cf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d198ff7-7ee0-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1699521340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699521340, "uuid": "88bdcbc1-9a86-49ce-a876-774486a0a911", "comment": "Malware payload (Stealc)", "value": "e5dc0ae6cb9073ef76e089158ebd5570", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699521340, "uuid": "9461434c-bd26-4111-876a-ca0ad5a2f4bc", "comment": "Malware payload (Stealc)", "value": "a33481be018bcb41f7e9c1e2279b980d9c470e5be3724b753c99a52d49a9035a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699521340, "uuid": "e4a3cf14-e455-4d17-9e3b-f563048c3b57", "comment": "Malware payload (Stealc)", "value": "b3ff7bb5160d7c4dadbcbcf5e1e24d4c436b9a50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699521340, "uuid": "9697c00c-a785-4ee0-b9cc-288307a71972", "comment": "Malware payload (Stealc)", "value": "1b1a5cffdb4aae5f1445439ab558019648918c7eb4ae8d58206684807eab6c8eb636ea4595a3ddc6ab7a2361e5176c68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699521340, "uuid": "c16320b0-bcc5-45f6-ac02-ab92d76d70e9", "value": "T18F446D13E2E16C7AE6274E318E6AC2F8261EF9614F143A9A13F5DB2F09701F2D572711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699521340, "uuid": "48cc459c-fb03-4257-a5c0-14bdaa6ad09e", "value": "1fa828bfc0140394bdc5d377f3be6913", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699521340, "uuid": "f7e9ad23-35f2-48d3-b706-b6cd1307bc07", "value": "3072:RWDjPyCUc+8wisjWkIw9F9ua1SVPhqOyR9jRZMvGkSpN2ACsOMx:RoyCUc+VlWkf9Fp1spCj2moB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699521340, "uuid": "379415db-b5ab-44d0-a214-ab935d26ed27", "value": 261632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699521340, "uuid": "9d5b09dd-d8bf-463d-b5f9-5ebf0815ea18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699521340, "uuid": "559b56fb-ea3c-42e4-8013-05641f72c26b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "299a9482-7f1b-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699546513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699546513, "uuid": "6f147d22-e11a-4723-8fee-23933667a19e", "comment": "Malware payload (RedLineStealer)", "value": "4fa2ee9a63975baf97706121f112425a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699546513, "uuid": "4bdb08d5-2eba-4031-ae89-7181dbe7fd95", "comment": "Malware payload (RedLineStealer)", "value": "a4f3b478d75618345ccab921fd3979fc8eb4c455129d3f83d7f1ada70e3f8349", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699546513, "uuid": "b26356fd-a1ab-43e8-b809-1366e9550f2c", "comment": "Malware payload (RedLineStealer)", "value": "b4eaac041be742a27f0b82499d0f49181443be62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699546513, "uuid": "e864c757-1d2b-4482-8bc4-4d928e7d5fb0", "comment": "Malware payload (RedLineStealer)", "value": "0caf24a3139595aa3d74323b227eca65790fb41ba58fa17cbb2fb2f56f59f53eee307ce8dba4dcfd8c1e07411b585e44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699546513, "uuid": "3db09129-89ae-4f91-862f-b69fc7d8b6f5", "value": "T198944A291C77F15FC0CDAD747380A58A4FE5476B0A08CF5CD6EB023A259F5412DBA2AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699546513, "uuid": "3d8b3906-7de6-4904-bcfd-b8f7b13a402a", "value": "6a7cabd14fc64dd10f6203f547570307", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699546513, "uuid": "c700a578-9a06-491c-969c-a283abdcf787", "value": "6144:tE+f3QiVzgGZS2ViMzeXp+R+yyCxY5Mnau59h81gCMHakKP:txZrcnKeX4RfM5MX59GQakKP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699546513, "uuid": "477edeae-8b35-47ab-8d05-73f98f1945bd", "value": 416160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699546513, "uuid": "ec1352a2-4031-47d7-aae0-0531e58a4452", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699546513, "uuid": "76eb374e-e745-49ac-b383-30dc56efeeec", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "904caede-7ea7-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699496864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699496864, "uuid": "66f94c26-a7ee-42f0-977c-faf9bce920d2", "comment": "Malware payload (RedLineStealer)", "value": "0261bd6d84c8a4fdd9f3216260b2d89c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699496864, "uuid": "a1d0b743-616c-41fc-a0c8-f9b965eee6d0", "comment": "Malware payload (RedLineStealer)", "value": "a59d33669232269be920d6b941cad88a67c443c042c6320fd5897202703a0130", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699496864, "uuid": "7868bcd2-340c-4eb0-9051-3d7e5ebf0a65", "comment": "Malware payload (RedLineStealer)", "value": "286defa3fd1e0c2ec8663d07b732ca4fd309c027", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699496864, "uuid": "b798e08c-0f3b-4918-837e-a709f77de7e0", "comment": "Malware payload (RedLineStealer)", "value": "6c06e46d92496d6e54dff1a6e3bde609e1986161305ba1bbd2d3276b74c8610c0f7352797fc910b539f2244d8a8cdad0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699496864, "uuid": "ac879a45-2d41-4c11-b7ab-3d4d7a737bf5", "value": "T1D7543A3B1875B6D7EC4F007F939892880AD2C93955CBF14C99E4463DB9AF0E2867708B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699496864, "uuid": "27eebfa8-733e-48c8-a7d9-49034c7207c0", "value": "4f29bee3c5fce0c203ea20f2306d1cac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699496864, "uuid": "0e64505b-165b-411c-b8e9-6acc613abd84", "value": "6144:RgmJYr9stHKs+4xLHNpj8gMoXwkFL8nXm6:/P84B4gTwkFE9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699496864, "uuid": "822dab2b-53d4-4830-af13-c05f306cd9a5", "value": 291664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699496864, "uuid": "fbea4e17-0509-4e4c-9c99-55e197b731e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699496864, "uuid": "823c3740-1eb8-46fa-b4fe-78b16aa2fdc8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c9a9d70-7f57-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699572476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699572476, "uuid": "8f916f8b-9f1d-4775-841a-77526f18b9fd", "comment": "Malware payload", "value": "abdb9f2513681e8804ea89c8e200e5d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699572476, "uuid": "6c6e45a0-296c-4290-9048-18ccf1d19fee", "comment": "Malware payload", "value": "a658de17617d561305d3da2ce053063f0c6565f6866821e5b52f5230101991dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699572476, "uuid": "48219814-caf9-4799-8f62-f0fb76b78e41", "comment": "Malware payload", "value": "2f2a9bbd0bf40a9a9e98a2aa27561c38c9cd4607", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699572476, "uuid": "e35b490a-818c-4d63-879a-f04938142c11", "comment": "Malware payload", "value": "b55366fcaeabcf25844aae8a414e943e3a0efe90a24b4ab3e06f4713dcf08d3fdfd5fb3b2d2adddd8c5e68e63acd495d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699572476, "uuid": "904fa63e-0e0a-4504-8d33-d384e1408897", "value": "T13EB41252F7D88071DDB967B058FB06D30E36BDE0A9B4831A2785681A1C73AC4E5713BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699572476, "uuid": "294d0ed7-8d82-40b1-a1f5-f5c5342fe8bb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699572476, "uuid": "80c34bcc-297a-4025-a064-4e040562b49d", "value": "12288:eMrYy90S1g8WGxiwkVQY8TUs2Cux+4+wSR8Fx3GiKyUDO:uy9yXQYSz2CuEUS+aiKC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699572476, "uuid": "3d8279a7-b48c-4693-b15a-090d6cc8dcdd", "value": 523264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699572476, "uuid": "7f8a6e48-e4c8-4e70-950a-29c69eb057e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699572476, "uuid": "1a4dfce8-92b1-4032-aa63-c09361e7fa69", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51b96275-7ee1-11ee-8907-42010a9c0042", "comment": "Malware payload (RisePro)", "timestamp": 1699521669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699521669, "uuid": "f3af924e-bca9-4b79-a062-f9a32855d2c9", "comment": "Malware payload (RisePro)", "value": "6fb531631a9ad8fcdf18a9401ccb40e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RisePro", "colour": "#92F3D0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699521669, "uuid": "e11048f3-608b-4e6a-8c2e-7fd0807c689e", "comment": "Malware payload (RisePro)", "value": "a6c6bf17707544149d3d580fa4b1818abc255014c6daec2cfabd6b5c9e34d5ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RisePro", "colour": "#92F3D0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699521669, "uuid": "c08ba0a5-293e-4a39-970b-bae51871b544", "comment": "Malware payload (RisePro)", "value": "2d8182bf2549a2cf2d6dc714c27f47d56fb8e0be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RisePro", "colour": "#92F3D0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699521669, "uuid": "02863f57-efac-4f66-8919-2d114e25c552", "comment": "Malware payload (RisePro)", "value": "e43b2593feea4bf1cfcb7867ac4960ff6c4d021e38188a499aa88d24f6d5fbc2ec44a0740fb2cccfeefe044f56245e87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RisePro", "colour": "#92F3D0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699521669, "uuid": "b19d3882-7177-45ba-af4f-057c3afc1441", "value": "T123463342FCC20ADDD06A8274281EFE4C75F95DF64674C91BA4A8AF9FC9C36305536A23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699521669, "uuid": "c2ed4f28-b618-4ca5-9b43-a670e2882597", "value": "876a2ca719e746752ee3e24644ab94ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699521669, "uuid": "aca2123e-91bd-4116-b822-92ab67b12ee2", "value": "98304:99WV/FFjX0vBLR2a7UqtBcXW7PB5yDfJTUt5PhiUxAnrMYMijFNzu78r:99gFFApLR7DD7aVUtxhFSHxNzu78r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699521669, "uuid": "244a57e3-2289-4191-9f35-33b8860acafb", "value": 5612216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699521669, "uuid": "3b415504-e8f9-47e5-b3a6-3294354575de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699521669, "uuid": "6be0630b-d609-4d69-922f-bd285d7201da", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f665082a-7f0c-11ee-8907-42010a9c0042", "comment": "Malware payload (Pikabot)", "timestamp": 1699540414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699540414, "uuid": "aa3fc3d5-aa46-4875-a545-cd12ca52ddbd", "comment": "Malware payload (Pikabot)", "value": "1e64f3868dc8dc63eea055b19f2a73d1", "object_relation": "md5", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "pw-H17", "colour": "#5A0D28", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699540414, "uuid": "1e6d5bea-1a30-48ba-86ff-c4f2ee4b2697", "comment": "Malware payload (Pikabot)", "value": "a71cef0ad51fbc6ba884bfafe81caf4b96e0d9f269259a6ff1984256e7c7682a", "object_relation": "sha256", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "pw-H17", "colour": "#5A0D28", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699540414, "uuid": "26265531-0c65-4bf7-b9ad-86a166de4145", "comment": "Malware payload (Pikabot)", "value": "f33c52ef48bbb176c1f36b0c95eb48bd0265fd8b", "object_relation": "sha1", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "pw-H17", "colour": "#5A0D28", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699540414, "uuid": "81dd7766-2cf9-41a3-886d-3c7ecd339183", "comment": "Malware payload (Pikabot)", "value": "fc5a42b1764c0cec9e4c7bfbac28b61b812902ce8a1fcfd9cf507efdf1d84f2327f9cf45c9c86f8018eff956bf7d2a7b", "object_relation": "sha3-384", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "pw-H17", "colour": "#5A0D28", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699540414, "uuid": "0226ef07-3196-4bef-968b-bfebcdaeb3ea", "value": "T1C134236DF3C8984AF782DF010919FCEA9DFB81244DB5EDA25CE7603F209DA168DA2505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699540414, "uuid": "2c72f9f8-7ac5-4309-ae86-6732827a3ec0", "value": "6144:NM/+Y9PN/lpfuLPhbAy7EyHmFVYCRzGgQSH3kwatoupVNGY:G9PdOpbAylcVNRzFx3kBRTh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699540414, "uuid": "e18b729a-fa83-4e2e-9344-b8779a637c49", "value": 250657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699540414, "uuid": "531ceedf-33e8-494f-8271-1d92c9bc8b8e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699540414, "uuid": "528bc6b9-733d-4760-9b63-1bb180bdffc6", "value": "EJTP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c12b165f-7eae-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699499952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699499952, "uuid": "e2ada173-d8c0-411d-a79c-eefcb0c5aaa4", "comment": "Malware payload (AgentTesla)", "value": "9eb0b3effb7b3f368269006de82c5225", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699499952, "uuid": "f8c2daac-b729-4fd4-8d21-c615a39b83a0", "comment": "Malware payload (AgentTesla)", "value": "a8c8e8ba3a18a34c8404770d291583d45136837bf99f52dd2015bbdfba5f5a50", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699499952, "uuid": "233f4602-0a56-47c4-b311-adb08142acd1", "comment": "Malware payload (AgentTesla)", "value": "b1e7b0d15978b05ced4471d17b882cf39c565fde", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699499952, "uuid": "eb8e367d-7127-4839-a3dd-0fcd139527fe", "comment": "Malware payload (AgentTesla)", "value": "a80582dcec7c7419fa042fac0d22a645445c788aac2ee53369a063acc74cabf59a85c8309641cfca742dd12020f14430", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699499952, "uuid": "515aaf33-4643-4600-bbee-f1251ca065c3", "value": "T15CE47B3D5DAC1637D2B9DFA58FC5D12BF1C0A9AB3151AD78A4D303A64302A56F9C023E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699499952, "uuid": "e0f0eb31-fe57-4e46-8736-f625581bdb71", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699499952, "uuid": "72c2bf4e-628f-41dc-9b0e-1a6982838c27", "value": "12288:13C0WXi8NAYaU+une5+17svXkAzfmGAUl/ClOrQr1:9CrR2GXe5K7WkSGw6YrQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699499952, "uuid": "2c3b52cc-ace6-4c58-9a71-096cfec7d14a", "value": 701952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699499952, "uuid": "e5f4f6ad-e8ca-4680-89ea-faefc9900971", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699499952, "uuid": "809bb69d-da57-4f52-add0-700ccea07545", "value": "SecuriteInfo.com.Win32.PWSX-gen.20973.14658", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61309f3d-7ed0-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699514394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699514394, "uuid": "307d97ca-258d-4678-bf9f-c572899c17b5", "comment": "Malware payload (AgentTesla)", "value": "05963f94aa47934625a54269c1a57b92", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699514394, "uuid": "4c6c22a1-aa40-4345-8da3-d3c7715a973b", "comment": "Malware payload (AgentTesla)", "value": "aa20239f6d96d11a0cc20dee903b1a37176555e1e9225f7cb6ef8eea28cff30e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699514394, "uuid": "99d9f9e8-0ef4-431c-8aa5-dfc068eebd56", "comment": "Malware payload (AgentTesla)", "value": "3336197134996a24f6a547fe5973241f8a9c7faf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699514394, "uuid": "97318f00-2f5e-4422-bf89-ed331f558837", "comment": "Malware payload (AgentTesla)", "value": "35d2d15aa141cac8731ea947111c9c44f12bc3e83541b88938ad4aad40deb19b4a966140648ccc1353811265bf607a28", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699514394, "uuid": "7903e01e-1182-4c2e-9755-260e9af9de85", "value": "T129E423B4C86D5281824B1321A13ADCB5CD05995E95293FE3903C7F76CBB63B63548C7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699514394, "uuid": "230f3fc1-2cb2-4e79-b0a9-056dc3f23849", "value": "12288:aeV46WjF7HPNA1X6FDrX8vvQYH0YvoXwW8tp2OaUlklY0T:aeV46W57Pg2rX8gJYbpFe3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699514394, "uuid": "5107cda5-f460-4581-8307-7ce115cb19e5", "value": 666862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699514394, "uuid": "1be48ee1-e418-4290-95a8-f65d9b31b782", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699514394, "uuid": "f60274c8-d72d-42e2-b73a-e8f2a38456c0", "value": "New Order.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e3922a1-7ef6-11ee-8907-42010a9c0042", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1699530737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699530737, "uuid": "6dca92eb-5e5c-4f6b-b47c-b8b0b4758cdd", "comment": "Malware payload (AveMariaRAT)", "value": "dacf4c31f57ee1d994a82414d813e9ae", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699530737, "uuid": "b8cca1c5-f899-4a66-8691-ffc54899d948", "comment": "Malware payload (AveMariaRAT)", "value": "aa4733132e1e49d5cf289d7ecf23fad6e6bcbd34b58f5bead0265c7a0685ebde", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699530737, "uuid": "ce48d342-8034-45b3-9e8c-baa9f85a5bba", "comment": "Malware payload (AveMariaRAT)", "value": "13a61df40525c9baa8d489f6c02e2b1ac5bfb8b2", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699530737, "uuid": "57dba099-c91e-403b-87ef-7eff64c4fd92", "comment": "Malware payload (AveMariaRAT)", "value": "d418739d88fe2dcd6d514f4ed0a589613134c09540401e774e568470c319912add4b46b0cf2c9cb854d38ee17ac06b94", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699530737, "uuid": "6edc9ee6-43c9-4c02-8207-9866b8589fdc", "value": "T16934F10B3782CF9ED6813275D815C2F06379CE46C066FB97A4AE3C6C7A376DC2219694", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699530737, "uuid": "9b242aae-6d48-4fbf-bd6e-16768f6590b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699530737, "uuid": "6f0465ee-4b3f-46be-ad41-8758a67c73aa", "value": "6144:QYwQ7jH8zQqrC406Zi8bfmXTbyWFpiwBP/DGDMDSj:ns/CiZi8bcPTPrGS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699530737, "uuid": "1d195a63-aa09-4706-978d-1d15d89562f9", "value": 238592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699530737, "uuid": "0da24ce4-ef85-45b4-a6b6-033717b6f788", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699530737, "uuid": "4ea071dc-3912-4faf-81e9-f658f5e794da", "value": "aa4733132e1e49d5cf289d7ecf23fad6e6bcbd34b58f5bead0265c7a0685ebde", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "871d9587-7ef6-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699530778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699530778, "uuid": "a4cfff18-cf5b-48d2-aecd-efa481a627d4", "comment": "Malware payload", "value": "98dc7cbd1c60d821b515c6ef8e2cc3b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699530778, "uuid": "271a235a-7c7a-400d-9bda-189d599f4bc6", "comment": "Malware payload", "value": "aafe5c8046cf623328babe0c9e222e7c19ffd56b48032e117b50dafb02018ec5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699530778, "uuid": "23c6f967-ecd5-4dd5-9c3f-03c3b0823b63", "comment": "Malware payload", "value": "d60dc72ad2adb5037f8bc503a353f8e5d167b415", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699530778, "uuid": "1b67fb20-ae40-4935-ab87-2b78cd4277cb", "comment": "Malware payload", "value": "77bd28da392f528a70ce72dda3ba60339b8a391f378a727ef3f55a5187a389541bb7adb7241d9bb17640b7163d8ea903", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699530778, "uuid": "86bad858-84f7-4b83-baba-63db0021d1ba", "value": "T11C3423F58689E167C1860D30FDE20D52EB4FD7B9C4548AABCF50466AC353DAB2B1FA01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699530778, "uuid": "a0fab527-bbcf-467d-a1f7-8791e65e1445", "value": "18c89e2ec0a399c68eaedd6551ce71fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699530778, "uuid": "d829cd0c-0c44-4e60-99c2-c1401f456369", "value": "6144:rnXSkFsC2IS90cTqjeLxi+eUfnMVvMhJDo/fcCy/gm7cWD1:rnRsC2IedqjeLx4dlSo/fcC+x7P1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699530778, "uuid": "b1e1321a-2c03-4ee8-b67e-36b6c7f57dc3", "value": 250880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699530778, "uuid": "f7d411f2-8137-4906-9393-80b32c2be9a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699530778, "uuid": "63d5993f-1445-471c-b657-22623602a269", "value": "aafe5c8046cf623328babe0c9e222e7c19ffd56b48032e117b50dafb02018ec5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8ffccd1-7ef6-11ee-8907-42010a9c0042", "comment": "Malware payload (CobaltStrike)", "timestamp": 1699530969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699530969, "uuid": "c55de44b-12c7-4c24-8187-a149af80f9a9", "comment": "Malware payload (CobaltStrike)", "value": "9da736adab506227cddcb9a410ecce56", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699530969, "uuid": "4dc21ff6-df9c-4d20-a827-ef7d4d5cce8e", "comment": "Malware payload (CobaltStrike)", "value": "ab25bbc030aa19bb74f1e1442dc0b719d2927ba93c4be352327367488170157b", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699530969, "uuid": "637569e1-2568-4ae2-8d10-6500486c16de", "comment": "Malware payload (CobaltStrike)", "value": "c3ecb0c36ab5ef62412ef2009c126909c663c3d4", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699530969, "uuid": "0777dddc-da89-4882-9ae2-720293dc1b07", "comment": "Malware payload (CobaltStrike)", "value": "53cb18db79aeca4154409b9a0c03f425cdbd8b541dff604ff4fb562030ab2100ba4e49f1b76c203e6b35dee806b70baa", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699530969, "uuid": "533e1b72-5842-4928-8ad3-26ec19b52452", "value": "T12364AD39FC00AA1FD84D85BD8B54EB4E91F8471AC349B19B75D84CEBE97372B4468B08", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699530969, "uuid": "31c8a6db-2b93-4f25-8fff-f1fbd6e9731e", "value": "66f0bfa36ed0065e6e524f6c1145e87d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699530969, "uuid": "22ea7d6f-6171-488b-a5c8-e56503a73fbe", "value": "6144:9ZIBiWzgKmfnY/xclO6FfGESuugw/eOg5sp6Xo4u0u6YWOWLbIBmZEGdnZC1:AugxJAG6LONmZEGxy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699530969, "uuid": "69d28809-0566-468d-8657-d82cd5e0346c", "value": 316416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699530969, "uuid": "e99cc072-feec-4c57-9ae2-9fe0ad5d5655", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699530969, "uuid": "6f4cac1e-f385-4002-a734-e1a7b395ae1a", "value": "ab25bbc030aa19bb74f1e1442dc0b719d2927ba93c4be352327367488170157b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f21ce82b-7f12-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699542984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699542984, "uuid": "07e0e75f-8e80-46c8-a8e2-5d0d1c48a664", "comment": "Malware payload (AgentTesla)", "value": "9e8467e2787f0458d2654f6aaf1eec1c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699542984, "uuid": "92ad8aeb-9ed0-4da9-bf2b-7206cc54d863", "comment": "Malware payload (AgentTesla)", "value": "ab7ba4e67277ba9013c77c7674aa9f64c07dc2af4f081b9ad9918d74a6802387", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699542984, "uuid": "8664ef5f-fee5-4b01-9c61-4459da81d8cc", "comment": "Malware payload (AgentTesla)", "value": "2a7af75eedd8046ecd3858fda74ece3ae9c0db31", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699542984, "uuid": "abbb228f-8c0d-40b5-9cf3-3d99d2f9693f", "comment": "Malware payload (AgentTesla)", "value": "4b6d8070f25b3cb8583b8d8f86e448a0501b022380ebae3e5657be5dd7819bba22257213254f0457e835eeee061677d7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699542984, "uuid": "a896f35e-f3b5-4e71-b289-41bb47360b5a", "value": "T1C7F47B3D59AD1237C2B9DFB58FC5942BF0D4A9AB3151AD78A4D303AA0342E46F5C123E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699542984, "uuid": "9ae26cbc-69c9-40c8-9066-0d8a0ad8323b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699542984, "uuid": "af717106-384c-42c0-966a-3e0426b32877", "value": "12288:a8YyjzO5slgxDDMbI7RqFRHeBtqzhntTDr9GqmDLulpPy+gWs+W:FYKzbq1VqFRDntTDr9GqPPy/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699542984, "uuid": "164dfdcf-ea3e-49f0-9a16-76e1a3ecfd66", "value": 725504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699542984, "uuid": "11cc54c5-3112-4686-890e-5a842ce9703f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699542984, "uuid": "5b06dca4-7249-43d2-96a1-02066d234d17", "value": "SecuriteInfo.com.Win32.TrojanX-gen.25313.32298", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c77466f-7f54-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699570945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699570945, "uuid": "e780fa05-6884-4153-ab58-3c7af4a27db3", "comment": "Malware payload", "value": "3d0056f8198cd4528ebc937bbf3542a2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SVK", "colour": "#3492BC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699570945, "uuid": "618c5ee9-97fb-4d7b-8811-81dc6ff5bebb", "comment": "Malware payload", "value": "abe91f2d0f0cc81dd6f1f7b9a9fdc2f9a513476831b77f473c5304fb65c7aa78", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SVK", "colour": "#3492BC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699570945, "uuid": "b4efb0fc-6df9-4161-b5f1-ebe2df08c084", "comment": "Malware payload", "value": "ce06565100918f26037566ce28b69c777efd3572", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SVK", "colour": "#3492BC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699570945, "uuid": "a5aa35cd-715e-4cbd-84f6-a0b141766a83", "comment": "Malware payload", "value": "2afe59c99b2c5f366d825dff4ae9ef542a0e7255acda3e3122152546b9787786cceec5af0c15bf5d3b2fe26c1bd8e3b3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SVK", "colour": "#3492BC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699570945, "uuid": "47c58ad1-4a28-4bc0-bf3f-86054980f3bd", "value": "T13D24089877C1F8C502A35A77351F6567FA3A6C2A28484420E100FDD8F4FD12EE9A7E79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699570945, "uuid": "87f4a643-42a6-4a1c-b7f8-96b7ae2ee3c7", "value": "3072:zFJethgffjIfp7gwh4je2TVEgGkv7i6a2ReLltWu9w:pJesf0fp7griDG7i6vRElIu9w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699570945, "uuid": "ae5bdcc6-01f8-4303-89a6-9d747ca6111a", "value": 216107, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699570945, "uuid": "16894a23-32fa-4fe1-bb3f-65ffe41dfcf4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699570945, "uuid": "70f1a2fd-4172-46d1-98fd-8febdaf1226b", "value": "MNHVR.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "010d3c07-7ecd-11ee-8907-42010a9c0042", "comment": "Malware payload (PureCrypter)", "timestamp": 1699512944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512944, "uuid": "6e57d88e-e290-4197-a3f8-4ec886602648", "comment": "Malware payload (PureCrypter)", "value": "be0b416470bf59a7ac6ca0fff1637053", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512944, "uuid": "76140236-16a6-435b-82e4-4dee223ae3ee", "comment": "Malware payload (PureCrypter)", "value": "ae8d6f701b1518f0cadc87634620ddc17b132aadeae0d388ed7ba8e5412cfe86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512944, "uuid": "a14dcf11-9118-4abc-9419-630bf1fab0be", "comment": "Malware payload (PureCrypter)", "value": "60785f9cc7810ad275fd5fdf4e2ceb39da60b287", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512944, "uuid": "813a7371-8678-4ba5-a069-d8e51aa1196b", "comment": "Malware payload (PureCrypter)", "value": "e4860643b18c354efbf95ec40180cc3e4cd66a7443bb658397342b4eb76b5a7f107efbcfba4d09f41a52dece1a14a0e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512944, "uuid": "9df90743-0968-4570-8640-91679d2d95e0", "value": "T1CC630A07F79A85B5C25857BEC6AB59040378E582B6D3EB0EF88E674A19073F6CC4074B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512944, "uuid": "74ef7a5f-f604-41f9-ba8f-713f35f49742", "value": "1536:OgsQ3CIBKdgWf/mCdFpq4EBgy1kUdzaj1N1AMUcEAeNTZHOS5QnvvT:4FV/TpqDBgy1k1j1N1AMUcEH9mXT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699512944, "uuid": "1fb4d64d-ba2c-4df1-908d-52f59d19ccc2", "value": 68608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699512944, "uuid": "73901a42-5ac5-47a6-bf47-b288f4cb33c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512944, "uuid": "27f99f93-ce94-44d4-95b6-8939ef6fd3e6", "value": "Sample Design 2.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a5a6ef4-7f1a-11ee-8907-42010a9c0042", "comment": "Malware payload (MarsStealer)", "timestamp": 1699546165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699546165, "uuid": "6fb506bd-a75c-4c98-ba46-fffe7cdfeba7", "comment": "Malware payload (MarsStealer)", "value": "93abcd3bfa24d4549719a308f7ae99cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699546165, "uuid": "7df88a2e-f2b8-4953-bf90-921e5b38ddc0", "comment": "Malware payload (MarsStealer)", "value": "afaf4393c80aa3b346505ebfbf20d20ba56b71eb34b09cf1a4b811f4ba39b21c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699546165, "uuid": "a8d0f717-42ff-426d-b7b7-724481d6f2bd", "comment": "Malware payload (MarsStealer)", "value": "6c3a6b71613fea46a4ca69f57a4fbd805b704cf5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699546165, "uuid": "8b35c661-64b5-430a-890a-6e14b2074a37", "comment": "Malware payload (MarsStealer)", "value": "d6fef7e813e4fc031625e982f7fbc3d95949db7ccae8ac6cf84e447006e3ad74f6d573f22d2727b52caa0ca45d76f159", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699546165, "uuid": "27eb9f40-8538-4caf-9591-74456023936b", "value": "T1AD444C13A2E06C7AE5230E339E6AC6F4661EF9614F157A9A12F4EE2F09701F1D572313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699546165, "uuid": "eb6bd849-5a6f-47f6-bf6f-9982f75969b4", "value": "bdd0d029a2e2ed32505aee0758e09d05", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699546165, "uuid": "aa796ee6-3957-4db1-950c-508726d6af03", "value": "3072:TzYleDHUUd2icjlqrpbxp6K8n3V1RNJ843Q7NcJy4oOyx:HZDHUU81lqrp98JLsK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699546165, "uuid": "e0be5867-61e9-4558-9111-e5a6574e7a78", "value": 267264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699546165, "uuid": "bf16d361-a9cd-41d0-991f-bdb27962caf3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699546165, "uuid": "8d06c670-96f6-4df0-b062-f35e65caf642", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72d454ca-7f00-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699535039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699535039, "uuid": "a154181f-c888-4a2a-860d-f33018737f00", "comment": "Malware payload (AgentTesla)", "value": "e116e166c516c2b8dcbe34246b60bfdb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699535039, "uuid": "6850bb6b-b062-47e2-b0ec-d7f70cb312c5", "comment": "Malware payload (AgentTesla)", "value": "afdf7a2b26a6004d9a27bccf7269af03707613c8d88a570cd3d156f6dbd2381e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699535039, "uuid": "34032f6c-7c9a-4d71-8309-546429297da1", "comment": "Malware payload (AgentTesla)", "value": "23b4157fe3ebe64239656d6281420d9fbd1d2002", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699535039, "uuid": "3d0ffb9b-9fc0-4257-b42a-6d281fe15f31", "comment": "Malware payload (AgentTesla)", "value": "22b816089b348de4ed31d9b48368dd7b315a8c5df85dcd7062c4c14b7455f013479d44cecd0640d9be0b5ad59a9b554e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699535039, "uuid": "cc2c6d7f-796f-4bee-b859-47324ffa6bd9", "value": "T157D4233A3545337CFB17AA905FE1E3A03435310A1EC5D4D94E3F648B286189BB96ECE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699535039, "uuid": "24f67617-082a-4858-9620-2bc0ed04084b", "value": "12288:xkodDEUP2VS2B5WNO3Cvj9PoFDYnfkTvC9basiUV+TZbUYm:xkodUTWNzvNoFDYcTMeUV+TZlm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699535039, "uuid": "701ddbbd-6afa-4c3d-8b95-d5c45a7aed65", "value": 604577, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699535039, "uuid": "0ab9964b-1c65-4da9-b5b6-3837965e1876", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699535039, "uuid": "dc5649cc-de7c-4b19-8aea-5dd268768300", "value": "2023-11 CV Forner Eugenia.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d403f0ad-7ef0-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699528330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528330, "uuid": "7328e093-be34-42fb-a523-25d3cd0a93aa", "comment": "Malware payload (AgentTesla)", "value": "9d6e3beef02b1febd80eb98f3adc7123", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528330, "uuid": "8c2a26bf-9d0a-46f7-b8c4-658808493b49", "comment": "Malware payload (AgentTesla)", "value": "b2a1e4398be0a08615ae686913f07b3560c3a4a0b9100011fc6b284bcd36a587", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528330, "uuid": "5dd4aa18-3a53-4fc0-ab11-46b4a623c15a", "comment": "Malware payload (AgentTesla)", "value": "875bf0326c711f977ba4e933e4129414b2f8d898", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528330, "uuid": "f859b77b-179d-4ca3-9f16-0bc362540c58", "comment": "Malware payload (AgentTesla)", "value": "b1a790a7a89753a452636b91c7b19e7d1f879b346b2fd7e88adaaf54f44e195ec7cbb406ce9f0fcb74b3236dd5fb999e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528330, "uuid": "690f4fcc-134d-4049-936e-3239181643ef", "value": "T19D15CF81E94856A1ED289BB22632ED305737BDBE6874E11D2CDD3DEB3BBB7920411113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528330, "uuid": "53e69550-b8b3-4097-b9ee-4665a25c61cd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528330, "uuid": "44588af9-3e50-4bc0-82ed-34f65fbc2c1a", "value": "24576:Ouf+CSVdWYL4IDDCuOsND7h5OeiZ+Oqcob1q:OufrSVz441OajOek3qfI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699528330, "uuid": "5f165721-e8c3-4ee1-ad05-52ba3857d64e", "value": 904704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699528330, "uuid": "0caf00ce-5947-483d-8caa-f4e93bd1c0b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528330, "uuid": "4c56924d-694a-474f-91f3-5595ee931c5c", "value": "Overdue Payment_41313883.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b958f42-7f46-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699565119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699565119, "uuid": "b71622d5-ea14-4080-b450-fc1cc5ca425f", "comment": "Malware payload (RedLineStealer)", "value": "cfb62df3f786093ef1342d46efac7003", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699565119, "uuid": "27294806-4225-4c3a-863e-8116565b9c52", "comment": "Malware payload (RedLineStealer)", "value": "b3303b37e83fd0e8dd858de00d4940b9a599c207ddc9ed92eb6bb93b5c1ea0ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699565119, "uuid": "4a92940d-8491-41b5-8554-d205ba732de6", "comment": "Malware payload (RedLineStealer)", "value": "681ef79a16112a8fd696eb11530d00993b130d0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699565119, "uuid": "c794568d-a39a-45da-8910-5a23c258f499", "comment": "Malware payload (RedLineStealer)", "value": "5775832ead8e55f67e9016ad64a2c7129bb2d5db801a83424027a06ad4d19c3dcd42540edde435c92a7f1f0c7cdebceb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699565119, "uuid": "37b2e492-4866-4704-8664-a460cd1e1d74", "value": "T1B2B41252BADC5072ED7417B068FB07D31E363DA0A9B8836A2786581F1CB39C4653633B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699565119, "uuid": "c589c1bf-86d1-449a-aeba-08c07eb4068e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699565119, "uuid": "511de75e-56de-4918-b1e4-fa542166295d", "value": "12288:YMrby90IJIEcPiSDkyJlOwcWMiUUY8TUs2euF+4+wSRWFAjor9h3xO:zycPVAnWxPYSz2eu4USMh3xO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699565119, "uuid": "b616bcf5-0567-429e-a8a8-7e3f138498de", "value": 523264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699565119, "uuid": "311d9bd5-5ace-413a-afed-b5b48baa87c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699565119, "uuid": "8b712a3d-eb01-4bea-8193-d057d7d8d291", "value": "cfb62df3f786093ef1342d46efac7003.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ceb17c4a-7ef0-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699528322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528322, "uuid": "fd2b086e-78a5-42eb-9f3c-fd1719f0406e", "comment": "Malware payload (AgentTesla)", "value": "cf368af1a0fecc00356cb2c1c5f42e85", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528322, "uuid": "6f99c6a6-7866-4451-9cdb-bce341f1dcb5", "comment": "Malware payload (AgentTesla)", "value": "b464503ab5fdacc459a998b697d242da9c3ce8785429c9adf47d5bac6e5aa85a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528322, "uuid": "a9229da9-fa50-4cb6-ba7a-6b00a8e2dbe5", "comment": "Malware payload (AgentTesla)", "value": "0bf088d59c9d5e38d1757f5fc8a5e9e152773847", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528322, "uuid": "d82482ee-0f32-494b-9ef5-5193c7526fd3", "comment": "Malware payload (AgentTesla)", "value": "92d0cac6872837ff2a786f471b5a641340a32a227b67050b5588b3eb6dc77b4d983dfa7c129eabcc33bd7d6cee939a29", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528322, "uuid": "a5fffb94-9a25-4a5c-b326-8fcb3ec10017", "value": "T19605115836BE6FA7D5BA53F9B025690007F4B12E2176E2249EC671DB6671F400F22F23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528322, "uuid": "f9615cc1-350d-4afb-96d6-8448249344ab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528322, "uuid": "2edd7e5d-0d9f-4f7a-ac83-63c76599fa69", "value": "12288:njoa/irttCyjT+lMaydg3hoeAI67ug3HEHZrBmSBPGvXbX/X/ReODnsaqkLlY:xCSlMaJho3ImkHZvPGfjHRDTHLy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699528322, "uuid": "7b2001ef-fb4d-4426-ac36-3fcdbfe1589a", "value": 815616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699528322, "uuid": "981b8895-848f-45ac-af66-1f93ea26b49b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528322, "uuid": "b626340b-e407-4c77-a88e-33463ee11a54", "value": "chima.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c1ba3f7-7ecd-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699512990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512990, "uuid": "898baeea-9b1c-4c83-be7f-7bcbfefe319d", "comment": "Malware payload", "value": "ba1e446144b436b142687f8ba1153cdc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512990, "uuid": "b9ca61fa-a40f-4eeb-aafe-8508b58db0d8", "comment": "Malware payload", "value": "b4ae33bdffd6ea4ac799ff8425c6e9dc4863fca30dd2368c6b264bf372208a20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512990, "uuid": "c2bef101-27ef-416b-86da-8bd470ee711e", "comment": "Malware payload", "value": "3069cc6eacfb1900c433d232cdffed62f3999697", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512990, "uuid": "be6447d6-3e3b-4b79-a6f2-2dda81571cac", "comment": "Malware payload", "value": "969e6fec7c04d7fbb04c23cf0d385657495fc6deef5cc2b4de50550dc544b6de119bee95d0366952c3e6dd9c79869130", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512990, "uuid": "7a9d9c8b-66df-4ed5-8a48-f405b2f6a21f", "value": "T19BA2298CAEAEC953CAAC16BD54F6074A1778EF2FB441EB0F5D8CA52528533D104E02E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512990, "uuid": "93f49726-2568-4ee3-abbf-690af58e40ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512990, "uuid": "b46dee2c-02dc-44ec-9363-d40476fbc625", "value": "384:uatlNRRFYXSvWjGHsDwm27kOaXYs1PFzSiiay9ycyrsR2vZz:JtlNRR6iludxgycyrsR2vZz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699512990, "uuid": "a205aeef-8cb6-4908-a7c2-20462da2da62", "value": 21504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699512990, "uuid": "d43584a0-85df-4918-8556-5dce9bd9e7f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512990, "uuid": "57b2a1d4-9cf7-4b29-b1b6-f5c05a5d5f3d", "value": "PO-003 Requirement B.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1351a055-7f3b-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1699560219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699560219, "uuid": "bbab0f6f-164d-46af-a8c6-0c4b6596bfe9", "comment": "Malware payload (RiseProStealer)", "value": "894739287dc6a1520898cb43fb907469", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699560219, "uuid": "b024bd37-cbce-4a8b-82d8-eab334f29dc6", "comment": "Malware payload (RiseProStealer)", "value": "b530a2087673ed69dc41860af27c4239b209ef8fe3f68c16864141e671b879d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699560219, "uuid": "f88b5892-b6eb-48db-902f-1b41b97c5daa", "comment": "Malware payload (RiseProStealer)", "value": "79dc4420c04035eaf4f007f3c6720866419ad893", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699560219, "uuid": "277826a5-a04c-4d6d-bcbc-dd78bca30117", "comment": "Malware payload (RiseProStealer)", "value": "94e6149768c42ed95a8fbbc25a53df68dcee47c7776a2d27314b29541300042312990d7244547eea23cb21bc92bd07f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699560219, "uuid": "311ecb2e-4b23-440c-9492-3516c409ea91", "value": "T13AD53384D1ECA320D91638F15E09F095E67772A1E25C022B9BDC74211C6BEE96FF163E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699560219, "uuid": "8a7ef7b6-0b18-4e5c-a9fe-91fad3ef99a8", "value": "8ee2c6a2015e4a91d0ec4c06a1bcc956", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699560219, "uuid": "5f7817cc-9620-4767-b2db-48dbc9c87074", "value": "49152:c4hILyUZRl2rooDXWeGvkxlHrOHEngUicVYRUx0MZacvf5Ss:c4yWdk2XWT8xoagQYLOacr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699560219, "uuid": "b630d1f0-4285-4af5-a718-69ac733c5157", "value": 2857656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699560219, "uuid": "cd684bc2-a9c1-47b3-9366-7877c80e67c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699560219, "uuid": "e86a5075-bc78-4662-96fa-88a721f43503", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "890a8d48-7f3c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699560846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699560846, "uuid": "ef4a0125-199f-4f25-ae77-51025ac1efaf", "comment": "Malware payload", "value": "ca1639a018ea8890cf70d8363ae2dff8", "object_relation": "md5", "Tag": [ { "name": "luna stealer", "colour": "#84D520", "exportable": true, "hide_tag": false }, { "name": "LunaGrabber", "colour": "#F26F44", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699560846, "uuid": "b1c870e3-17ec-4508-839b-2614034a115a", "comment": "Malware payload", "value": "b5f602421c9cc9519d2178383c2e0afd652f662656be3b4f3de5c47d0413bc42", "object_relation": "sha256", "Tag": [ { "name": "luna stealer", "colour": "#84D520", "exportable": true, "hide_tag": false }, { "name": "LunaGrabber", "colour": "#F26F44", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699560846, "uuid": "24319d6f-0bdd-46f7-9362-fa851be3fb9b", "comment": "Malware payload", "value": "c1dea933c569741ec3649294b8800ec0c37b7737", "object_relation": "sha1", "Tag": [ { "name": "luna stealer", "colour": "#84D520", "exportable": true, "hide_tag": false }, { "name": "LunaGrabber", "colour": "#F26F44", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699560846, "uuid": "f7f16234-6bd7-48ca-b950-243e728c46f6", "comment": "Malware payload", "value": "d98a1e3b7e67bd5092bebe35fb999e0c1f8d15b90c5c3e263f6ec93c1008e81fa362a3b3a439499d8d1149d2132a46a3", "object_relation": "sha3-384", "Tag": [ { "name": "luna stealer", "colour": "#84D520", "exportable": true, "hide_tag": false }, { "name": "LunaGrabber", "colour": "#F26F44", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699560846, "uuid": "bac99d00-fa07-4029-8cb8-bbba18b34a23", "value": "T1C1B39A855621E17E5B97ED292F43AECC2868D9EFC8C9E701F0C44A4FF4A863894E57C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699560846, "uuid": "3bd10303-475e-4bae-be4c-99fd15f3dda1", "value": "3072:9J5lPvX9A+do0GWFTZM+hps0MPawSngCwul5FKIbf2:9J5l3XndGWjhps3yvX2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699560846, "uuid": "34ac8dbb-cc78-4c54-8f4c-2e6e9f85562c", "value": 113359, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699560846, "uuid": "d9ec3732-8690-4f59-ab6b-7b25c406ef05", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699560846, "uuid": "029e3d37-3c12-49b8-94cd-795768349e23", "value": "chrome-bypass.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "820269cb-7ed4-11ee-8907-42010a9c0042", "comment": "Malware payload (Phobos)", "timestamp": 1699516167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699516167, "uuid": "8b288180-af8e-4659-83a2-dbc60b4520e4", "comment": "Malware payload (Phobos)", "value": "ca960a5f89e3d82dc4dec752e912fdc3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699516167, "uuid": "f9791334-2a66-48f6-8429-659f5812aadc", "comment": "Malware payload (Phobos)", "value": "b609555a43a2e1151f9ee7b028d0141034bfce25487ef2ec826d2af714e15ee5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699516167, "uuid": "88c1ce53-0c61-431b-bad2-ba29ea6d02b9", "comment": "Malware payload (Phobos)", "value": "04b7b4939788b1055c0909eee3bc0e96cf483127", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699516167, "uuid": "397e003e-a28a-4b73-a1c0-0f767e739932", "comment": "Malware payload (Phobos)", "value": "6738f4fd3366493ab828e3520d107eb18d4faa8f5bf151de45102a5fe16c0e99b10b3130b7b34544b612de1f6f78cd87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699516167, "uuid": "efba8974-ca6e-4195-981a-4ab9a4cb0d43", "value": "T13443AF0A746984F2CEB24670193A6F5B4FBEA50140B488875F3D4D873FD4536EB2A37A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699516167, "uuid": "985d09ce-dea9-4452-9518-496d23bafa55", "value": "851a0ba8fbb71710075bdfe6dcef92eb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699516167, "uuid": "f7232a62-1e65-4454-8fb8-d5066a90a7ad", "value": "768:EvrNNeRBl5JFTXqwXrkgrn/9/HiDKGwRj4RcTdyH4pYT3nPKVU1EwDXEkMd:ONeRBl5PT/rx1mzwRMSTdLpJwDzM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699516167, "uuid": "d4176b0d-cf55-43b7-abec-b10df2475450", "value": 57344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699516167, "uuid": "e6f1be20-bd30-4670-8b9f-48e5c82dcaf8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699516167, "uuid": "a28f6de9-9dd3-46d1-a6d6-854d0e9c767f", "value": "bitdender.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f03fae25-7f02-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699536109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699536109, "uuid": "f280cc67-2d9b-46a1-a4fc-57793832c268", "comment": "Malware payload", "value": "77ee19f76a09a51941f3e9ae48821817", "object_relation": "md5", "Tag": [ { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699536109, "uuid": "fe732e77-044a-4fb0-ace8-991f6c4f0ce6", "comment": "Malware payload", "value": "b77ecfddb35ec517d44e437d5cd032801d8c538893948ef660744cd7aefb3eb1", "object_relation": "sha256", "Tag": [ { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699536109, "uuid": "43b7e93e-abf3-46cd-86c7-e3b8340b4b8f", "comment": "Malware payload", "value": "ad969e017a0d330204874ef871847878d00d1f7e", "object_relation": "sha1", "Tag": [ { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699536109, "uuid": "8d6107ff-87ff-4e3d-bb17-b691925e349d", "comment": "Malware payload", "value": "7a60076ad4996bb8c1b612c18fa87c3c3aed37cd313cc56d79d8b08b56e53dacb0d85b2aa73814803f091ae13fe2c2bf", "object_relation": "sha3-384", "Tag": [ { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699536109, "uuid": "e28b2ac4-3853-4f5f-a26c-5ab24e3cab90", "value": "T190C13A7C6B79C708C29AE89BF353A95D9A8390DBE351517B0B235864A330ECD14BB0CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699536109, "uuid": "45072ccd-7bae-43db-baec-2e8e35524478", "value": "48:ectw7kvOga0G8OVaPUh2qFq5iQpSKtqK+Tv+mtQPTzhXJMD+aBnUr5G8LmvREyYM:eRCqF+Nf1ZMD+aqr622liHC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699536109, "uuid": "ca29024a-ee25-4f28-8fb9-c0a04ef07082", "value": 6081, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699536109, "uuid": "4f3d77f2-f1aa-427b-bdef-45c5ac1ecc69", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699536109, "uuid": "55ea7a50-adc7-48f5-a64d-a58bfb4deb0d", "value": "xt9644nb2.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12a28b9a-7f44-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699564084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699564084, "uuid": "9b3b7f47-cd6e-4c5c-b791-6da427e7cac5", "comment": "Malware payload (RedLineStealer)", "value": "37f8351de716b397f5800342e170ea83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699564084, "uuid": "e4f259d4-a396-415c-b3a5-0b883eb32802", "comment": "Malware payload (RedLineStealer)", "value": "b86c2c80111adf7bfa767e50d296fa015501ad9780c41a88c5680382e5abf037", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699564084, "uuid": "1792127d-6f19-4b63-b81f-12aa4f85fe48", "comment": "Malware payload (RedLineStealer)", "value": "ea45e463b99c8d71a16342ad51fc1980f7dab4b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699564084, "uuid": "07a694c8-efc1-4520-b21c-87b8484e1726", "comment": "Malware payload (RedLineStealer)", "value": "e67459f1bba3d7b1e38fdcb236ac7b9ee470284716d602ccaea55d1da17f0ea8fc2365032aaee1116e55c5a816a22aa1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699564084, "uuid": "fcb17a9f-d004-4cc6-8ff0-579f0101d4cc", "value": "T193B41262EAE89073EDB117701CF702D30E3A7C95A9B983263345A42F1C736D5A53636B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699564084, "uuid": "ef272dba-cecd-401b-ae82-631176355804", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699564084, "uuid": "80d6de23-557b-4821-a011-bfd8da80f44c", "value": "12288:1Mrzy90h+PiglLrY8TUs26uN+4+wSRuFCUAkr/e:KyS0iqPYSz26uQUSQUUAkrm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699564084, "uuid": "1df86360-cbf4-48b3-8e17-1400278fecae", "value": 523776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699564084, "uuid": "1005598a-3e5a-4849-abb4-29b615a12eb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699564084, "uuid": "fd430847-5999-4353-9598-012229aee550", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04271871-7f46-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699564918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699564918, "uuid": "554d83b4-307a-4d0c-9140-7adc09657e8b", "comment": "Malware payload", "value": "e062480b3de8070da8e56a9564d9ec59", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699564918, "uuid": "2b7cbd6d-ecfb-42ec-acc8-51bc5f04375e", "comment": "Malware payload", "value": "b8fa2a485cfe6db7f120bdc6a6e77652edd650a7c86c62f5d7056945d5f0092f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699564918, "uuid": "917299e0-da61-421c-a493-5ee7938c640d", "comment": "Malware payload", "value": "142cac717488d31984ec3a4f05b97631cc218ab8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699564918, "uuid": "a0f404d3-d3b2-4d91-926b-6951be864f50", "comment": "Malware payload", "value": "92b9083f45808f6ecc646adcf46f76c7ee9fa62c3cc2b7ab035e78a1d546247fc2c19bfa8591578991bc1f8af4ab620a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699564918, "uuid": "57f6435a-27f5-4816-9186-c79c5e538b52", "value": "T129357C0732915033E6B279364A1B429DC826FE261D78345A6BF9AC483D35643FA76FC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699564918, "uuid": "3bfeb873-3d50-40af-827c-5b614663f6ab", "value": "12288:vGB+OVpf2HcuPquvZ6qCUlmF/F0H4j5/AqyXkhgYtdaNPpMFZm9wKY8rT3m/aw3S:vKvzcrnyaLO+3Yb/wQeAh/7R+xDcI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699564918, "uuid": "f366d4d2-882c-46d2-8b5d-a3a3aa5f641a", "value": 1061888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699564918, "uuid": "00e24ea4-3f1d-49ca-838b-f317dece9bc6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699564918, "uuid": "ddedb2df-2b53-4c37-885a-a956b8155dcd", "value": "SecuriteInfo.com.W32.A-62389890.Eldorado.12520.18813", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8bbe555-7ef5-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699530540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699530540, "uuid": "44fe41a7-9978-4c22-9d64-96fe80524c04", "comment": "Malware payload (AgentTesla)", "value": "7db09723d7ec6eabcc1cf4be375f3ec5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699530540, "uuid": "c24009d9-f29e-41b1-b575-21b791f2a774", "comment": "Malware payload (AgentTesla)", "value": "b9034cdd69cc76fe7e83e37843f0a56b81a7871f7177953203d0c736e7551193", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699530540, "uuid": "c60b96ed-1f47-4528-8c2d-4690c46e13cc", "comment": "Malware payload (AgentTesla)", "value": "b349302e818e4ce193a714e8a2c3472fcf76676b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699530540, "uuid": "4dc1e407-da6c-4894-a584-6dc0671096ff", "comment": "Malware payload (AgentTesla)", "value": "ac157e3f3f1a43cc04c26a84e1562ce7cf05aa57c75db1034595fc203b8f12ddb7a47b82f3718c39b0ad3afbd51ea1a0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699530540, "uuid": "869c89ec-804a-4aa1-a244-79aed54ab646", "value": "T17BE4F13022A85316E6BB5FF9C87CB15C07787E5429B2D648CE9E33FA05F2B405960B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699530540, "uuid": "f19eb3f8-d116-48c7-a6fb-958b7b0614bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699530540, "uuid": "c61b0bc0-d700-4885-83b0-a81ff6a01650", "value": "12288:0G4k1vmBqRB3920Pa/IUmGED+HikA9SoE/dyL/tUEfa3iVfee1W7ii:hhWqRFy/IoEDf9SzgLtUM6iVfegWX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699530540, "uuid": "268457cd-fc7f-4949-82c0-00e4cac05fd5", "value": 706048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699530540, "uuid": "b1e48e9f-3223-4a87-8df2-fdc0af09730e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699530540, "uuid": "4fd80580-e4b2-4976-aa76-f758c3d6ca77", "value": "b9034cdd69cc76fe7e83e37843f0a56b81a7871f7177953203d0c736e7551193", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78e36388-7ef3-11ee-8907-42010a9c0042", "comment": "Malware payload (AsyncRAT)", "timestamp": 1699529466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699529466, "uuid": "2d6a8c7a-65c1-4c69-a998-e18c53e00e18", "comment": "Malware payload (AsyncRAT)", "value": "305d6745001bf48e43ab5dbb7eb281ff", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699529466, "uuid": "ae51a3f5-a318-455f-b997-77bd1d98ac4b", "comment": "Malware payload (AsyncRAT)", "value": "b923ff30fd180012590e759a6c012dd9a54266c021c1698cbe6e795a27ccc4de", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699529466, "uuid": "39e74832-88c4-43b6-ae50-b8c5a327308a", "comment": "Malware payload (AsyncRAT)", "value": "f6bae0c43b01b872dd5c333af81a449c4c7134a4", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699529466, "uuid": "658b168e-3c45-44d6-816c-123c111a922d", "comment": "Malware payload (AsyncRAT)", "value": "8cd878361e12d1301a9f8cf82614156842408f2d3253342cb8f5c8d966448fe4241718e70c01b4af5ba0d27be627bda1", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699529466, "uuid": "cfc89fd3-a94e-4b81-8eb7-23667c03d259", "value": "T14D7329302BD9829EF179CE7474A23271CE776D362D1EFD0ADC8834461B33A859641EE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699529466, "uuid": "cb1109fb-b225-464b-9d43-4d594c8f0f21", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699529466, "uuid": "b5c2d5dd-c653-43f3-9405-da4ef6ff56d1", "value": "1536:bu+01TQfb23pAybVigpUvTbKKmaZepRugJdfeZ5/EAH5Lt:bu+ATQfb23pbB9ULbKG8pRHJJoltHZt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699529466, "uuid": "770f82fd-ebd9-4faa-a4d4-728ba86b4f84", "value": 76800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699529466, "uuid": "d73d928d-78ff-4ff2-a1fe-e49f5e424b48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699529466, "uuid": "7b1038fa-dd33-444f-a5d6-c913280470f7", "value": "b923ff30fd180012590e759a6c012dd9a54266c021c1698cbe6e795a27ccc4de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc23c71f-7f58-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699573012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699573012, "uuid": "ee515e44-4cf4-432c-8b76-7e4f1558bfdb", "comment": "Malware payload (RedLineStealer)", "value": "6d066e4976429caa90950128f8fbaa43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699573012, "uuid": "c8ca02e1-1894-4896-bdb8-e6a1e3b6f8a0", "comment": "Malware payload (RedLineStealer)", "value": "b943e26c69dcc4fd644acb8a75b07560d931c098682e5c66426755280ec1d0b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699573012, "uuid": "c455b072-84d2-4e49-8fde-1505812ab7f2", "comment": "Malware payload (RedLineStealer)", "value": "316d35a7aff4bd3ed977968f639c9b6872ffd2b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699573012, "uuid": "532977cd-bbff-4b39-a0da-b7903688b71c", "comment": "Malware payload (RedLineStealer)", "value": "2c3c221d9cac8e9e2bfc1cb0b5e4f05c54a7acfb51dc33ecba295d64b02eb643f823501c8391230ba73f152220949d90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699573012, "uuid": "9846a6d0-d9a8-4501-8e3f-b3696c9db019", "value": "T195B41227A6D89072DCB453B429FB02C31A353C91953C832B7791696F0DB3684A9367BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699573012, "uuid": "1e58f430-1e6c-421d-9a8d-825a80aa18ba", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699573012, "uuid": "cd215248-b33c-4508-a3c7-e06e5073dca4", "value": "12288:3Mrzy90QbLplVzToaDNY8TUs26uN+4+wSR1FhEb8VUAkrpo:Ay1lVlNYSz26uQUSnDEb8VUAkrK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699573012, "uuid": "862d628f-7ccc-421e-b8fe-ad46f3c36ada", "value": 523776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699573012, "uuid": "01219da2-bd5c-4694-92a0-8d99aa4da6ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699573012, "uuid": "45cf7e85-6d73-4586-b6f0-f63812d09bcb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfd3e2d4-7eae-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1699499950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699499950, "uuid": "b6e85b27-abdd-44bc-b61f-62e96ad15754", "comment": "Malware payload (Smoke Loader)", "value": "aca63b9e4ab5a783f11b125c71112242", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699499950, "uuid": "afa0bf8f-7b1a-496d-bee6-3da600491765", "comment": "Malware payload (Smoke Loader)", "value": "baa0cb3bc60d90cfbe000d58b1e4ff06888722bfa81c68ef1486e7e48ba8740a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699499950, "uuid": "ac399f3f-0912-4f10-aa8f-2f34aea4265f", "comment": "Malware payload (Smoke Loader)", "value": "82baba92a2c1b320921ad05e56a5890f62697cf3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699499950, "uuid": "c0c7025a-2fad-4998-a2e4-8c37c9e07e73", "comment": "Malware payload (Smoke Loader)", "value": "a3f6e5c5b4a7880a7045e832e708b8594ce25390ddb521fd7c07413096443f6eea413e8b0b7ea461e81f7987394dd261", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699499950, "uuid": "28afcfaa-3229-40a5-acf9-b09a4ac847a4", "value": "T114C3CE0CE6E85B5FF2D504B61A240D947932B2E28292F41B7FFBD64431C729589F8FA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699499950, "uuid": "63fa37fb-a5ea-4550-8f2e-7fb3425ded84", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699499950, "uuid": "71c9bf63-9e35-49e6-bb99-d76a459f88d6", "value": "3072:rAnyTz2pBatCxtHgyYGapk/bBA6xNJJsLypMpoyKV:0nyThtCx93RaO/JxGu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699499950, "uuid": "673ec308-63b2-4f84-bb07-f1c620120db8", "value": 128512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699499950, "uuid": "44f2de1b-49dd-497a-8ed5-2113f052a69c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699499950, "uuid": "5056c93d-5409-4c32-b6c5-a7ea2d75cd3c", "value": "SecuriteInfo.com.IL.Trojan.MSILZilla.30886.28966.14387", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35310b96-7f06-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699537513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699537513, "uuid": "f91564cf-9707-4304-8c25-b24713872470", "comment": "Malware payload", "value": "54313c7abe751e3a29ddbd7b2804c482", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699537513, "uuid": "d3e195c1-0146-4032-bf9d-5bcea614400e", "comment": "Malware payload", "value": "bb0db6b1921a849d4892100a6ac67e9beb947ad9e2be83ab8d44ddcb21c074dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699537513, "uuid": "dd6da6f0-d5ec-4eea-b80f-3151719aa571", "comment": "Malware payload", "value": "c9dfe54bdbb859ce7deea5893fdf064813d4418a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699537513, "uuid": "af0da787-e538-43d0-b1d7-c118b906f500", "comment": "Malware payload", "value": "ce5a29b47fdf20e46571503940c0d6c409fd1f57a28d24af834ac48226324c32a8a577578349a86c5d2d6565985be61d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699537513, "uuid": "533177d9-7d30-494b-82e3-4eea49295dee", "value": "T195F43AC1BA81E032D0A301B5CDAAD77546B9BC219B214AC737C97F1EFD711C3AA36652", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699537513, "uuid": "9ef12fb0-bff4-43c6-a462-fbfa6d4e85c2", "value": "a0db7ef73ef297ffb2dbf1d432bd365c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699537513, "uuid": "cbf26194-7f80-42c0-9831-3573ee6dd127", "value": "6144:bj3+VSk78WBWh8CiXaS+XZZRHQFJqrT1X8nEM30DVSlnZ:brQ78Ww2XaljHQzqrT1XSkxYZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699537513, "uuid": "6d7646b9-0efb-4815-ba9c-cbb6691f72d8", "value": 728064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699537513, "uuid": "d31d40da-ab8c-40f8-a846-40a7ba788a83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699537513, "uuid": "a211f1ae-c6a6-4b83-b46b-f817ade761ed", "value": "bb0db6b1921a849d4892100a6ac67e9beb947ad9e2be83ab8d44ddcb21c074dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d26b7729-7ef0-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699528328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528328, "uuid": "6b103d18-64f5-4d5e-9534-25768b3d9479", "comment": "Malware payload (AgentTesla)", "value": "51a99f8293876d876c5c4b5a16364ce8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528328, "uuid": "a6dc4180-0045-41f0-83c7-629baff1736f", "comment": "Malware payload (AgentTesla)", "value": "bbf55f2b22413278c79a20912166b13f8dc086e13ab250c1d7265ca6cd09b2af", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528328, "uuid": "b28ec923-705e-40e1-aff9-c7ae376da611", "comment": "Malware payload (AgentTesla)", "value": "4db2ddfe63ec149abbe78c4fc6fe2a91da191cf0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528328, "uuid": "50c57522-11e2-453b-a80d-6bec19e0f23a", "comment": "Malware payload (AgentTesla)", "value": "35eaad946f693ded359236b9331bf61734c2724220c97f59b51cc7884441b811a0d5c947f95f119f4f681cc680b79d3f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528328, "uuid": "2a6ae20a-faba-4389-b2d6-8c840ba93b62", "value": "T1B9968DE722D91BD9C01BE574C312FE3FC6AFB43A0B21E69B4255E2255E23C45BE19B04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528328, "uuid": "795219f5-0dcf-4189-a00d-f32fa079b36c", "value": "fd4858350aebb518210521a885012543", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528328, "uuid": "4b056c6a-3e51-4fc4-8428-2402ac0ec691", "value": "98304:Ex8k/KhP9Led0SL6LyVeP/1iwZXayHsAYTm:9kYP9SySL6LfP/1iOUm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699528328, "uuid": "1e2ffd5e-36b4-41e2-8f68-01128deac895", "value": 8638480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699528328, "uuid": "6e76c122-1c49-4d39-9c6c-8660d8253083", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528328, "uuid": "d0deeb5b-e656-4ef7-a97d-5ec00e2542f5", "value": "LOI DFT-DTB REF EPHCOP28402EHS4Q REF ARAMCO 11082023-PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1307b22c-7efe-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699534020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699534020, "uuid": "d983a10b-85dc-402b-a6fd-cb3bd0f1b3c1", "comment": "Malware payload", "value": "f670f98fa5fee4b29e017d7af323202e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699534020, "uuid": "3799fce3-6f40-4189-a53d-8f6785cc01be", "comment": "Malware payload", "value": "bdcc000e7794ded80e6e87fa7178d9a19f135c7112b0dda07f9c2f29c241b198", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699534020, "uuid": "de672069-d94c-4f89-9570-3bd34e689e7e", "comment": "Malware payload", "value": "0de1645ade86cfbedbf059b73202e02f6e004dcb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699534020, "uuid": "bee535b1-6212-4a6b-a453-d26a14b02c10", "comment": "Malware payload", "value": "e57481614c265f6144793630bf14415c4eedfa7b0916b7eff45abfed78c19050a4239e38d7471ee3ab14fbd14ecfdf71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699534020, "uuid": "f7850add-4569-478b-8649-ae2efcfe8471", "value": "T1C604D617B78A8BB2C7C85B37C5DB15040775E682B293E70A798FABE918433BB9C01547", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699534020, "uuid": "d6bf3651-1051-47ae-a284-dd62192ad0e0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699534020, "uuid": "be2f9709-f491-4441-a428-3677601d9362", "value": "3072:6/hsnjwZnl/PguFRAhBS6ntpxXSJTwAZW5YeritWdZFA:Iyn4tPg7bS6ntpG4nitA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699534020, "uuid": "6c1cb74b-b24c-491f-b9e8-f69252ddc38f", "value": 183296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699534020, "uuid": "0a611303-5a2b-4688-9a32-08ebacc2d540", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699534020, "uuid": "afa4cf8f-314d-4fca-9e6b-61f054d58171", "value": "justificante de la operaci\u00f3n.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0af666b9-7ecd-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699512961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512961, "uuid": "9b69c3bb-e840-40ff-988e-a510bfed5322", "comment": "Malware payload", "value": "64c9907a3243d5365b41cb747d8aad56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512961, "uuid": "5ec4ca58-e381-4f29-98bc-fa5ea5fab697", "comment": "Malware payload", "value": "be08811c7f83cdafa74eabb6f6cc0a8ceb477bc65493fcf6acea8795f9747402", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512961, "uuid": "3c959b44-d967-45f0-8016-4b44174bc2b3", "comment": "Malware payload", "value": "1c89b1eec7d54ac1c589a6224f786e5899de2cfc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512961, "uuid": "f7ae2be8-a0f3-4e24-b7c6-df46287f431d", "comment": "Malware payload", "value": "23ba1305a70a9f3cb379d1701289559d6b353a64ba1223226ee434ea03a30fda4ca6e74772325c9757f263f85708569a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512961, "uuid": "f21c8c0e-1d30-42a6-8221-a94f611250bb", "value": "T14365A307BA6B89F2C2495737C6DB141443A4D7A17323D60B798F236A19433BB7B4932B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512961, "uuid": "b9f042d1-78e7-4e54-817c-13eafb09736a", "value": "24576:ZRSv/Hw3ntPKdTmFNO3LHHti/1lgernHWQngC:WIZKSXnWQn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699512961, "uuid": "52e382d7-79af-44e7-848f-740d4cc6c588", "value": 1531904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699512961, "uuid": "8c0bb1a6-1e81-48ee-ae97-24e57bfb771a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512961, "uuid": "1ae184ff-64ef-4f25-ab9b-c36463729fe2", "value": "Artwork & Photos.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25d92f26-7f0a-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699539205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699539205, "uuid": "b0747457-13af-468e-971b-d1e319fa79c6", "comment": "Malware payload", "value": "3289555041182195912551f212ea3c8e", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699539205, "uuid": "272c7d14-fe88-4b96-b714-1b6ce3900f10", "comment": "Malware payload", "value": "be4334ce0be2683878c5b9fb911a4fb9beaaa09845028215134081268621df38", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699539205, "uuid": "613235f3-b62c-40f3-9c32-64e5c6a8d82f", "comment": "Malware payload", "value": "8ab3bc00e60a1d56d50ddc737c213988d5cb7b32", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699539205, "uuid": "168d9bc7-2607-4abf-9128-61e4120cca71", "comment": "Malware payload", "value": "996c0b25b8143983fdf6391aeaf2b825073f31096d425f99142e3155115f2e9236655102b316b3f78d9ead2e4f702558", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699539205, "uuid": "432d6cb0-20c6-411d-8531-011a51e8c4ac", "value": "T13A15335B24841CF7DC20573EFAC22A4F086EC017A1C617A91AEEAD50737719F6D76A0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699539205, "uuid": "de26a4d8-e499-403f-b9de-6d4ea6552534", "value": "24576:M8zCp4yCEgUuJ+cUZ/i36ypV2jXhgn88O1:LCCyDCa/iKASin8R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699539205, "uuid": "83f9ae2a-b2bd-493c-9610-05d75cd8853c", "value": 944619, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699539205, "uuid": "3c3ff667-e736-41a2-bc4e-19dc258d88d4", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699539205, "uuid": "78da0856-7e99-48f8-af3c-3d0c9ad17f5b", "value": "usersfiles.war", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fca6117-7f1c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699546899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699546899, "uuid": "33e0b95c-45c4-4816-ba08-d2ce6f442680", "comment": "Malware payload", "value": "f63056686e9506a338234af7e6422b2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mispadu", "colour": "#B829D4", "exportable": true, "hide_tag": false }, { "name": "Ursa", "colour": "#C6451B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699546899, "uuid": "d836a93d-bac6-4788-b821-2e59308dd28e", "comment": "Malware payload", "value": "be771c5c8d2f3813ff9d8aab24c9d953fdaa3606eebcb528fe0e26e6d05ad244", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mispadu", "colour": "#B829D4", "exportable": true, "hide_tag": false }, { "name": "Ursa", "colour": "#C6451B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699546899, "uuid": "a7a21be6-4a18-4d4d-b647-20116d3ce90a", "comment": "Malware payload", "value": "02fe5b2124ad7b9f1d6a190288acf401ea272a2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mispadu", "colour": "#B829D4", "exportable": true, "hide_tag": false }, { "name": "Ursa", "colour": "#C6451B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699546899, "uuid": "34d5d76a-2218-4531-9c61-0e8b534530c7", "comment": "Malware payload", "value": "b524054119b08aabe2813001cba16fab7539438dd6e8c2424b09e353988ac9f77c25b8a74a1d68f67bbc20c57f84b972", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mispadu", "colour": "#B829D4", "exportable": true, "hide_tag": false }, { "name": "Ursa", "colour": "#C6451B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699546899, "uuid": "04c14573-8898-4cb5-aab3-28cdab84aa1c", "value": "T19656AF23B288553BD0671F3A58279694993F7B202A25DC8F7BFC098C4F376406E26797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699546899, "uuid": "2ccb5e21-8fca-43ad-baf8-85a6edef993c", "value": "e3bd87be67cd52cc55889c46604dcafe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699546899, "uuid": "2c5325c4-16be-4815-b4d7-a9db45f64e82", "value": "98304:JoO7KtDcE19x6GE6PThaHUQybUqcnqK0qKkadYB7:jKtD9ElnB0BkadYd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699546899, "uuid": "af97a035-5adc-4c3d-aa93-f5e67f2ade40", "value": 6317056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699546899, "uuid": "e6c10c9e-a390-4cdf-bf6e-8f73095f1e7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699546899, "uuid": "641e063a-9e77-4b1c-9ce5-d2be131c4e38", "value": "ursa.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49d30bea-7ed0-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1699514355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699514355, "uuid": "b40efc07-54f0-4724-8d5c-74c2c51a434a", "comment": "Malware payload (Formbook)", "value": "4b2f3143f4271dfed806f6e05b847190", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699514355, "uuid": "c08d5c0b-b0a0-41dc-87ea-6d5fd0a895e5", "comment": "Malware payload (Formbook)", "value": "be9fa4bd2766fc5e1d06a60c8e9fffcdb6d0c7cded097234b573abf97a19cc41", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699514355, "uuid": "e56db550-8486-49b2-b1c7-fb5d377a86d9", "comment": "Malware payload (Formbook)", "value": "0e9bedfd27a0696e27104bf17573270a96630c0a", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699514355, "uuid": "613e41ac-d190-4638-8bb0-702d72022973", "comment": "Malware payload (Formbook)", "value": "f40bf27cc05c2f85c40ea30a4a4b6b210ea120303419876b1573cec29227ae45ee36cf5481446fc5b2b19d455028f69d", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699514355, "uuid": "272d5e83-ec36-4814-8fe2-89c7cbeb6a38", "value": "T105E47B3D5AAD1637C1B9DFA58FC5846BF1C499AB7051AD78A8D703A64302F46F8C023E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699514355, "uuid": "5afffd55-94e5-4020-9502-6462f1cc27d6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699514355, "uuid": "b7b8b049-03a8-4d86-8ccc-066b252cc313", "value": "12288:oUJ5PWYSpW99JP7kBZjwopnbOdf0JFDxwrBVUBA5O1m:1hW1pW937OZnSdf02r395O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699514355, "uuid": "02dadab7-b981-43bd-8d28-9141cd8540c3", "value": 711168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699514355, "uuid": "53db546f-f78c-4724-9e93-4e4602968b54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699514355, "uuid": "37ecaf70-24b9-42e8-95dd-cd69742f1289", "value": "DHL Receipt_#9552756186.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9c9dd9b-7f11-11ee-8907-42010a9c0042", "comment": "Malware payload (Pikabot)", "timestamp": 1699542567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699542567, "uuid": "a31749d1-e90d-42a2-86e2-b8e10faa70cb", "comment": "Malware payload (Pikabot)", "value": "1544bc5dd75f8b1bb0e42fef7091ae50", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699542567, "uuid": "1c26591f-2624-4e19-bca7-755d782f3e1d", "comment": "Malware payload (Pikabot)", "value": "bec37a8dbfc218b308ac05da2915dc5f6c94fc4fd58fb81e755209d5db92835e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699542567, "uuid": "6d33cba4-3609-42ee-a1b0-ebf8dbb0a655", "comment": "Malware payload (Pikabot)", "value": "ca22caff4be021a1f371239a6262cc5037a20f80", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699542567, "uuid": "efe03d1c-458c-48c9-96b4-a8a4d5213541", "comment": "Malware payload (Pikabot)", "value": "3e62ab2383c2cb6667b3a3fa8e0720c13618a446d6704f0a42037f0fd2d01b44c6d70a1278d56be43fe48850590e2127", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699542567, "uuid": "0b8f7fcc-d294-4083-98fc-367e11a78d11", "value": "T139A5E052A98AE0B2D09A5231AB7DEF9F451866374B38DCE772D02F25A07C1C3123E757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699542567, "uuid": "d1c9957b-6316-4080-b530-82df717137d4", "value": "a84830209fa1e49a9917a636d9a36ddf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699542567, "uuid": "4079384f-de63-439c-b6ca-a52fab6a8991", "value": "49152:4zdqXJqxcLD0YvMf/HyUZwnYVFQkcCZLjCWtZqPpu:4YUxqD0CINmnYVFQkcCZLjxtZqPp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699542567, "uuid": "6883b461-3d6c-4af3-bcf1-e29391dac5ef", "value": 2152811, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699542567, "uuid": "a613c137-81be-4a0e-a79e-da3237772d96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699542567, "uuid": "f0774f54-719c-493d-ba16-190f96486956", "value": "dll3.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff7dc8b0-7f3b-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699560616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699560616, "uuid": "138078e9-7255-46ff-9bd1-4483999f8c4b", "comment": "Malware payload (RedLineStealer)", "value": "90c23126f1aff49a74b53351938e7877", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699560616, "uuid": "03ccadc6-8b6e-402a-8f30-f003e67a27cf", "comment": "Malware payload (RedLineStealer)", "value": "bf8b2b9c3cdf5df97ee6a9f7e7739838c73e2d9b3dc15929bb2bb13a767080b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699560616, "uuid": "a4cde349-d156-4156-9745-21700b754d7b", "comment": "Malware payload (RedLineStealer)", "value": "42a0d89bfa040a704d7c2a649364ab5f6621b572", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699560616, "uuid": "d74edf90-93dd-4c4d-98cb-441f044e7267", "comment": "Malware payload (RedLineStealer)", "value": "20bbde29ea1dfc29c90969d0107a374ccdbc4b2063872a130d98e7f8ccc6791ed06125b19de4f4a75a1ed50be3a3d842", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699560616, "uuid": "71dacc68-8dbb-48f3-950f-a9dc9b119aee", "value": "T185B41213ABD88172DDB52BB14CFB17930B357CB24934936A2B85AC590C726C4A87277F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699560616, "uuid": "115c8dcd-e7e4-459c-a95e-6fb670d34643", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699560616, "uuid": "a64e6098-177e-418d-9ed9-e6e05d4b2e43", "value": "12288:nMrby90CK5QQGSTET38icELg4NkvSurOiFeZuDr:cyLK5QTZ78icELgekjrBFeYDr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699560616, "uuid": "d80a1f38-3c04-4412-8f92-44d1138576c1", "value": 523264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699560616, "uuid": "e80b6084-516c-48d8-930b-ce762b6bf121", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699560616, "uuid": "c9e101c1-d03b-4017-90bf-f02c21dfd04a", "value": "90c23126f1aff49a74b53351938e7877.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e61be5a-7f24-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1699550413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699550413, "uuid": "20399707-f557-4416-a103-255b0a78f461", "comment": "Malware payload (Formbook)", "value": "17c36a8cf4c8c2a87e5531b2b667f596", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699550413, "uuid": "78142662-be2f-4948-89ee-92d569a8a8c9", "comment": "Malware payload (Formbook)", "value": "c02a181d05c0a4faa7fa9c5eac1dc8fa20794e8e854452cd759e7c8d6881852c", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699550413, "uuid": "d2623fdf-2c39-40fd-8fe3-0427a8455ba7", "comment": "Malware payload (Formbook)", "value": "e5c2f946149763af44c113c42f8e2174fb9dd71e", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699550413, "uuid": "38569b0c-703a-42d2-9ca7-5ce16c725aed", "comment": "Malware payload (Formbook)", "value": "ecfabdd0b5db9f618e2c701ff78df86173807f3857c7dcda5298d779d6a72c1640c2d2cc0084bd8292087041f092f92f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699550413, "uuid": "07ec55e8-17cb-41d1-ae64-4e7f30d48a15", "value": "T178742303BEDC8166E50C81DA5F046E124988BA6F1A38572B931F0ECD8A47DDC37DD8B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699550413, "uuid": "8c388a07-0677-4cbc-a968-49adcc484084", "value": "6144:4d2SE2sjeCOWxSOYFe4rcpIUxl3JbiST8VFyPRbH36:ADs+KSveKwIUxl3JeS5D6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699550413, "uuid": "3e16f484-c974-46f4-be2a-c5e029dfde82", "value": 340500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699550413, "uuid": "38eb8215-6c81-436d-833a-aa92e888a152", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699550413, "uuid": "8f4418b6-3a8b-4915-b3ba-a7a46d7a81b1", "value": "PO 44223.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "343983c0-7f4a-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699566717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699566717, "uuid": "5c420c93-75eb-4463-aa76-21a459a45ded", "comment": "Malware payload (RedLineStealer)", "value": "09ea418a58b0ce618ac768488983107a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699566717, "uuid": "b69b07b7-9af6-4b3e-89ec-3d55654c0c53", "comment": "Malware payload (RedLineStealer)", "value": "c10a2bf3195e2845d300da532b6dd148b5ec3630307fb04ddc01e0cbd381d0ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699566717, "uuid": "ff760503-b271-4431-81d1-58d2b3839218", "comment": "Malware payload (RedLineStealer)", "value": "10320817bbcd26c582083177811e5c142b39a44c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699566717, "uuid": "9dd07c3a-4fb5-46c3-a51d-7e9566305543", "comment": "Malware payload (RedLineStealer)", "value": "43a416698fca149b95b9b3b1ecc6e47cffde509fe6dbe48538c05dfbf7ec4636c77c3afb2b3092cb4098c76dd9745373", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699566717, "uuid": "94987526-0b92-4fb8-a289-5d51731cff9f", "value": "T1C4B41252B7DC90B2EDB4177518F602E30A32BCF1D57883AA3785681E0CB36D9A67171B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699566717, "uuid": "69058600-17ad-455d-892f-ff9e15c58d50", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699566717, "uuid": "924ecd05-1f82-463f-9f08-bd8d576c7349", "value": "12288:PMrsy902IhgTbZ6vwpe8Y8TUs2MuX+4+wSR9FCV5ft4:Lyih3f8YSz2MuuUS3Cfu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699566717, "uuid": "26538dfb-ba74-4256-8c7a-cae136cb8de9", "value": 523264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699566717, "uuid": "407db3f0-b72c-4c2c-996f-e868f16ba3a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699566717, "uuid": "8fb8a7af-b004-4e41-90e9-efc2fc4e5a35", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c49769c-7ed0-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1699514359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699514359, "uuid": "6948e1e2-52a1-4203-bbdc-900c8e72fb80", "comment": "Malware payload (Formbook)", "value": "10b3d7bf0908989230549cf5ee191774", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699514359, "uuid": "5104b250-05e4-4977-939d-df2c6914e5d5", "comment": "Malware payload (Formbook)", "value": "c17b3e778d12a1b353c665515c1de44df04d6172f0448b62c9cf6dd9e44bb6ca", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699514359, "uuid": "e98a146f-7e40-4278-befb-4855f0b2b3a6", "comment": "Malware payload (Formbook)", "value": "923c3d8d95e2e3d6b538fa1342987671e1ba7c98", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699514359, "uuid": "fc733f14-0e8c-4a4a-868a-ea3b4875e5f1", "comment": "Malware payload (Formbook)", "value": "432ed19193528e7aa4961552a7c2ef0ecdec9968ea42d1b3320a3d9fa896e5fc602d75eb08a4c423d483ec535538e640", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699514359, "uuid": "f752fd39-868a-4004-8583-6aae09344eee", "value": "T16FE47B3D5DAD1637C1BADFA58FC5856BF0D0A9AB3151AD78A8D303664302E46F9C023E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699514359, "uuid": "6938e719-2061-44ba-bb50-5899cd758d96", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699514359, "uuid": "77b369f0-65ff-4b87-aaf6-6158e714eb8a", "value": "12288:M7Nq2/6N7CO2Fw04Yl6xF1uMQLMXaAThAFZ+kbAIWtDqO:MdSElpl6F1NPtOEkb3WVqO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699514359, "uuid": "1f6f090d-3dae-4e84-84af-c3376b6a5b4a", "value": 709632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699514359, "uuid": "12aa7572-c584-4e5d-8b83-fb875e50c4a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699514359, "uuid": "92452490-15d7-4901-b96c-91e7ab1b6673", "value": "DHL consignment number_#880595460.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "492536e1-7f49-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699566323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699566323, "uuid": "5258369d-26d7-4f57-92a8-adc618a69223", "comment": "Malware payload (RedLineStealer)", "value": "7dd204fcc12430937185c9453119c3f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699566323, "uuid": "ef6bec5c-ef9e-44d4-87a4-e165d5ebe943", "comment": "Malware payload (RedLineStealer)", "value": "c4cbf7a8ca90df698d3ebc4580e1f0b73aca2ef45e3748c019af83e8d3057dfc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699566323, "uuid": "f3e35768-5f8f-4660-ae17-4b0d5238bb11", "comment": "Malware payload (RedLineStealer)", "value": "14faa6ad329ac195d9bd9b7bae5b8ed638f52732", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699566323, "uuid": "f641a2d8-f649-49f2-872f-2bda8659fa1d", "comment": "Malware payload (RedLineStealer)", "value": "1e85a25a7f22e035a63089634a2ca00cee36de0df73e7fbc214418451efcc2bf51561bdd1f6668272de5aa9c8da3592b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699566323, "uuid": "89edb675-2c3a-48e7-a20f-30dd78066bea", "value": "T124B40216AAF89073EDB517B15CF701D30A367CA1AD34C32B2785685E1CB36C4A93673A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699566323, "uuid": "2bb96949-1656-463d-adf1-5b0c5a18ade0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699566323, "uuid": "e5219179-16db-4c99-8fe3-991734d4d934", "value": "12288:OMr/y90LVLzOinDPw3rM8LFY8TUs2auF+4+wSRvFcL5GqPRqDHg:5yc2iD2rRFYSz2au4USVmgqZqjg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699566323, "uuid": "94397068-7912-42c9-88f9-aedbd2eb2027", "value": 523264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699566323, "uuid": "09325a9b-789a-4916-b7d1-472cd2e68935", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699566323, "uuid": "7d750a61-63aa-4233-b267-1246a0371083", "value": "7dd204fcc12430937185c9453119c3f8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb9ce7e5-7f23-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699550221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699550221, "uuid": "ec07648d-c81d-408e-904b-76f912967f2a", "comment": "Malware payload (AgentTesla)", "value": "200bfa010e25259a32c5ce8099f08f32", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699550221, "uuid": "c8000d50-8d05-4d42-9ccc-05d38a4d9b8a", "comment": "Malware payload (AgentTesla)", "value": "c533ace78801aeab71168481df83d55b17c23f720c427c875df2e1657310cce2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699550221, "uuid": "7110f015-9fab-43ff-9bef-7fa3d8734439", "comment": "Malware payload (AgentTesla)", "value": "4712bd8854c2a49fd67647d5d5ea1a4b98df85e5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699550221, "uuid": "27e654a1-5a04-4834-92d5-a4c8a84bfac2", "comment": "Malware payload (AgentTesla)", "value": "935df004f30df253703a84fd8a8a67841c77a98a18174c24b29d33c0b509a5d8862e84516f1b81e8c8f4689e8586639c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699550221, "uuid": "9e58a2d5-e33a-4eb5-8c1e-479b50858252", "value": "T1A5C423B2689C7DB67A4B45F7C300CC1050D9BAE4513D60B0BF997244BB9963A3A2DDCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699550221, "uuid": "461e970e-cd31-4189-a81a-e70d20ba43c5", "value": "12288:6YcuVcuwnAAFGuSa3aQRplsmCflsEuy5V0U7wk7chEQ4Iw73T33IUy:6w+uwnel8aQamCfz5V0UEko1Tw73T3Yf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699550221, "uuid": "67e10dda-c4f5-4b00-b108-3a35c5e5c8a4", "value": 577073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699550221, "uuid": "ea592ee8-0930-492a-bdec-9aef9aa59dca", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699550221, "uuid": "6ffdb044-6a0c-4d74-95fc-829b30fa439e", "value": "new Purchase Order #98540-00.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eca9938c-7ec2-11ee-8907-42010a9c0042", "comment": "Malware payload (QuasarRAT)", "timestamp": 1699508615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699508615, "uuid": "11c2d792-db74-4868-919a-12f2d7d8d989", "comment": "Malware payload (QuasarRAT)", "value": "2632513ef381e54f4b7067258c006f9e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699508615, "uuid": "832bd293-2a48-4eba-acae-075b7d8fe4fe", "comment": "Malware payload (QuasarRAT)", "value": "c54bb2c2ee3a6b72ad7867b134d3c257ce340c014d8d77fadc55aaa1fe225a72", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699508615, "uuid": "9a3502ec-7fb4-4ed4-aee7-5aed93845105", "comment": "Malware payload (QuasarRAT)", "value": "148bd0ce9229a2f101e845e770d528c23c0e4091", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699508615, "uuid": "887c57f3-15fe-4e9a-9208-df14cdc5ebe3", "comment": "Malware payload (QuasarRAT)", "value": "5140ada53d6fc7ac639a43f7eddf02dc7a46cf1dc9d0357d7fcafdddf455f42f293b99445dbfd61a33321a7a0931c8d2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699508615, "uuid": "532dfd36-e4bf-40ad-8bf7-9481888d71dc", "value": "T1A9E55B143BF85F23E1BBE27395B0041667F0EC2AB3A3EB1B1191677E1C53B5059426AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699508615, "uuid": "616f8748-6817-4c48-a400-0d06ad0bf677", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699508615, "uuid": "36e43a1a-ee71-451e-842c-52a4f78debf2", "value": "49152:jvHI22SsaNYfdPBldt698dBcjHhMxNESEck/i8LoGdNOTHHB72eh2NT:jvo22SsaNYfdPBldt6+dBcjHixPC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699508615, "uuid": "70cdb920-aec8-4247-9d84-06b95782e99e", "value": 3275264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699508615, "uuid": "043db5a8-a02e-44dc-bfe3-b22ddac6daa9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699508615, "uuid": "f4a0430f-0617-4a72-be3a-cd2624bd3a47", "value": "2632513ef381e54f4b7067258c006f9e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc2abf02-7f17-11ee-8907-42010a9c0042", "comment": "Malware payload (DarkGate)", "timestamp": 1699545094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699545094, "uuid": "7f460504-0945-4917-90c3-516c57ddc4f0", "comment": "Malware payload (DarkGate)", "value": "dbce75c89588ec7c8e71a2458c104832", "object_relation": "md5", "Tag": [ { "name": "botnet-PLEX", "colour": "#3CFE1A", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699545094, "uuid": "961639d2-8908-4b22-825d-406e3d6720d3", "comment": "Malware payload (DarkGate)", "value": "c57d3f4689a3621ea1ba7e1f18c2735598244ac1b26d712feaa1e19a408cc420", "object_relation": "sha256", "Tag": [ { "name": "botnet-PLEX", "colour": "#3CFE1A", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699545094, "uuid": "d2c766a3-9e43-4631-af5a-4c23a0f60245", "comment": "Malware payload (DarkGate)", "value": "15151d2fa90b012e9059c1c53933f8df3933bd00", "object_relation": "sha1", "Tag": [ { "name": "botnet-PLEX", "colour": "#3CFE1A", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699545094, "uuid": "cbe39fb8-56e3-4ba6-99e2-e2ab842d601a", "comment": "Malware payload (DarkGate)", "value": "4cbeca38a7e137422a3ac98e4c9076f8b5ce90a4e94ad8f8b0b0989b2447aa65413c2f38bfec0a4ad9b7dc2fa02d7811", "object_relation": "sha3-384", "Tag": [ { "name": "botnet-PLEX", "colour": "#3CFE1A", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699545094, "uuid": "4bff5e4a-3521-4ac2-b3b2-47017ca7de95", "value": "T178963329E10B4609D5C7773EC2087CE1B74093889BE4137B1E6D893522BAFAD4F95EC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699545094, "uuid": "dae8147f-a366-4cdd-8319-c507eb97c3cd", "value": "196608:26cMpzXjX04OzRlD/NFVt1hLekX7AveRu2v1IBeJHsaUezyaEzTJlrM705:HNzXw4OzrDL1hLekX72I7zzOaEztlY7M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699545094, "uuid": "33205adb-3829-4234-8479-0d6f5a3164be", "value": 8801349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699545094, "uuid": "f6abfd3c-4757-4da1-8b8b-26f9fdac4857", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699545094, "uuid": "21542426-1565-4a98-a51b-2e6b2f244f34", "value": "1c532f2594.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bdaf94a-7ed0-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699514304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699514304, "uuid": "0b60cedd-3012-4c45-967a-188e91c0e0ec", "comment": "Malware payload (AgentTesla)", "value": "b641dda80d125207bfa66f518a9bcc01", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699514304, "uuid": "a84459cc-eb8a-4560-aa0a-50d5e72a6962", "comment": "Malware payload (AgentTesla)", "value": "c5a1f3b88ad4e2dc4bd37a0659785d48e3ae058851c8d1ad1af4fb2051af0603", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699514304, "uuid": "759b3f44-bead-46f6-8aa9-2e28cbcb7d3c", "comment": "Malware payload (AgentTesla)", "value": "3dbd90b0edb556f06e6892c7a498c859ee370b2d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699514304, "uuid": "1d4f8245-e1ca-430b-8b0b-8c4bfecbc940", "comment": "Malware payload (AgentTesla)", "value": "3b68a946b1acf426e4c7b8d5527fe4410cf89da08b91a7d36382fb55de7e1d72c0bf4f46560d17256fa7328c0300ff03", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699514304, "uuid": "f6d73316-3ec1-45f6-aca9-c96436ba7533", "value": "T11E042A2077EE600CB1F37E961AFAB5A54F6BBAB2153A915E104C160F4BB3E40CD51B36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699514304, "uuid": "b1596635-e8a3-43f8-9a1e-8ffb150a3820", "value": "3072:7mRQePFWWWWWCWWWWWeWWWWWeWWWWWHWWWWWyWWWWWzWWWWW/WWWWWYWWWWWZ0j1:v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699514304, "uuid": "d6256494-6d94-4269-8adb-49e6c8de1bc4", "value": 178052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699514304, "uuid": "a0701815-f192-4f43-91e2-31a4f803ba46", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699514304, "uuid": "0251e2e2-0ced-434f-90b4-60edef63a2a9", "value": "Transferencia .vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "130e559b-7f39-11ee-8907-42010a9c0042", "comment": "Malware payload (MysticStealer)", "timestamp": 1699559360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699559360, "uuid": "7172df3f-459a-4d0e-b3f4-5ead5f9ce452", "comment": "Malware payload (MysticStealer)", "value": "0d3f03f3df67b0c8095313afef656d73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699559360, "uuid": "7cf85056-8b7b-4786-b8a5-2e953b46148b", "comment": "Malware payload (MysticStealer)", "value": "c6fb1a31d91bfcc028c56f8cd37dc2819a3a6c78a005f4b79d773ffcaa5d15c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699559360, "uuid": "d9e3c237-7faa-4c42-a443-3961495e54f4", "comment": "Malware payload (MysticStealer)", "value": "5d51e0428daa17d3b0f7c11efcc958d246a459ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699559360, "uuid": "c4880a4e-eee0-492b-99a4-f68e863e9748", "comment": "Malware payload (MysticStealer)", "value": "1f8beae838d8398f648ec55c1f323545ef9b28cc09fc6c9ba72382eed38db14124e5b3803df03c5d54808af5c28d8461", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699559360, "uuid": "43020e06-6eec-4cf3-bebc-0dc9d2110e8f", "value": "T1D474F113F7E85472E9B517B018FA07C31A3ABC625C38875B6785A85B5CB3184E931B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699559360, "uuid": "7313e85b-bd06-437a-8295-73187d0c7b7d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699559360, "uuid": "0fbdea65-4360-4d28-88f3-73a0a32f9b46", "value": "6144:Kwy+bnr+Xp0yN90QEOWQr7/kdFZzBM2dmHC7t8ME7hSuj2eRal:sMrXy90Mp7/OlBM2dmH285lGl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699559360, "uuid": "826d19cc-4792-43bc-a8be-ac21c11eb020", "value": 338432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699559360, "uuid": "24574d29-107f-473e-9818-40f3d254878f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699559360, "uuid": "0442bfd0-7476-4192-8b53-34637567b3a7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b312bb98-7f3c-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699560917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699560917, "uuid": "fe50d699-9de0-4104-b5c3-7e11f9d26261", "comment": "Malware payload (RedLineStealer)", "value": "17b936ed197b42834837bc834389ed6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699560917, "uuid": "d26a184e-c799-4985-b69e-b8708d0afa4c", "comment": "Malware payload (RedLineStealer)", "value": "c8c80fca0426a2c7099757b96171cfd2983417e32e3c32a0eb10a9e1d9cff76d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699560917, "uuid": "c5bc96e1-38e9-4184-a9da-af75625818da", "comment": "Malware payload (RedLineStealer)", "value": "538555412401014dd45810918dbcb0a76e446980", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699560917, "uuid": "6445f6cc-e126-4f82-9e1f-b3d742bb29ac", "comment": "Malware payload (RedLineStealer)", "value": "d94a61198db1ab433242e82869d5503481903dd45bc34e53a5faf04d574c32601711e5fd50664414168fcac4da231ead", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699560917, "uuid": "6b970dbb-9068-4237-93bf-490660ca98fc", "value": "T1FEB40243A7D98132D8B527F058FD15D30E36BC6199B883AB17C6B41F0C73681A875B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699560917, "uuid": "096aec8d-3735-4be2-9d18-105670ef7ad4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699560917, "uuid": "91be1964-694e-4f3d-b4a7-24b2fb3693c8", "value": "12288:tMrpy90r6anEERL1lXwZRV9jLJFf27xA8WOQQvPPWrw:0ym6anEEvtwXVLFf2tp4QvPww", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699560917, "uuid": "1f37483a-ad1a-451d-85c6-538137be8e5a", "value": 523264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699560917, "uuid": "08a1a4af-5e76-468d-bd8b-0b9a79c25639", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699560917, "uuid": "031ab030-8922-47e9-9070-795d37b6e29f", "value": "17b936ed197b42834837bc834389ed6d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59e4892e-7f55-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1699571505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699571505, "uuid": "e463fffe-9147-4e53-8f53-ac7b5fa63399", "comment": "Malware payload (Mirai)", "value": "6d3c78ad988374a2371d6b96965704ec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699571505, "uuid": "24d0b928-8b41-4feb-8fc4-3740953ac9a2", "comment": "Malware payload (Mirai)", "value": "c917d22387fccc2f4fdb0f074115a38e400e22ab99cc0d8b29ee511e04ea9c44", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699571505, "uuid": "2e427d88-ba96-424d-81a6-fc23e5c0aa8d", "comment": "Malware payload (Mirai)", "value": "752b2e68a3743905606371b317a1c7b20398f124", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699571505, "uuid": "bbada184-a1da-45ab-98cc-d26a401bfe74", "comment": "Malware payload (Mirai)", "value": "2caaa8ea4a09c2357f678a492850e57f9744dea4572cad0d0af4286e66b569f8c0a77df76272b5fa1e0c85a65b2b1c35", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699571505, "uuid": "844f2004-2bba-4cf0-a40a-6b9b9793b6ca", "value": "T13833F861B8926A1BC6E0237AF9AE558D332063E8D2CF3217CD201B157BDA51F0D67F52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699571505, "uuid": "250fde1c-e8c4-4298-9b4f-1c4384b36cb8", "value": "1536:aymy2hHuA6bBvUImk2ifflvYU6Ioh+kWXXkQ:aymy2hOkdU6hhT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699571505, "uuid": "5d5cad61-f30f-463b-9fb9-a078318d1676", "value": 54652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699571505, "uuid": "f00506c0-dc8d-4b6b-b64f-45bebffa594d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699571505, "uuid": "f4fbdb5e-e7b6-4a67-aa11-cc7a13ee6924", "value": "6d3c78ad988374a2371d6b96965704ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eac51a32-7ecd-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699513336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513336, "uuid": "df03c6e6-ab04-4b9d-b4e5-c2cad4eabc03", "comment": "Malware payload (AgentTesla)", "value": "294ad0fb854aa68e369b9a267ac22999", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513336, "uuid": "0ced4f5a-3302-4160-9955-6a9d9c2930ab", "comment": "Malware payload (AgentTesla)", "value": "c932629b109408fa120f1903b044820215fb4d86b3724651d0901d36c4346e98", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513336, "uuid": "aead5a95-8c57-42fb-b017-53e6ede91c13", "comment": "Malware payload (AgentTesla)", "value": "3a1a755212a73171554e13c1207968da952a2d79", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513336, "uuid": "c3e37e54-da5b-40f6-b461-1aac8193fa2f", "comment": "Malware payload (AgentTesla)", "value": "221ea4f87ed32a14f1f28369e104eb149e1cfdda6bf1a81a42794671a9943a0998873d47aed19ccaf5054c1ce0f99af9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513336, "uuid": "f10fdcab-5ac6-4504-bdac-a9f33f7ac299", "value": "T18AF4D01936785132DD04DA3418F25E15D6E7EEAD7BE0911A29C4B66D1F322FE8F039C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513336, "uuid": "ba988fce-89ab-4128-8584-f3f27f1124d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513336, "uuid": "532650a3-21a0-49da-a43e-225113268d81", "value": "12288:YivKKRmQHMtt8jFQKatqxnuXL86icBPcn6UK25:jvhstwyFqooeE6O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699513336, "uuid": "4382d73b-8ea8-4955-bcdb-1e01070c3f8b", "value": 727824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699513336, "uuid": "0b073da4-da16-4c61-b953-44f74a01cc21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513336, "uuid": "07d94835-e803-4ed6-b565-4c30f7e4b68f", "value": "QUOTATION_NOVQTRFA00541\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09e119ad-7ece-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699513388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513388, "uuid": "e9c0c405-f136-4411-b073-bc2fdd275b57", "comment": "Malware payload (AgentTesla)", "value": "6fadf52e1aeacb18fb854ede98b4cf35", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513388, "uuid": "1ed61fd1-242b-464e-9f76-30cdc922a127", "comment": "Malware payload (AgentTesla)", "value": "c9514e25c856d4e05b1eae9ca84dfa9db129cfbd294a875d53d4f1f913bd5276", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513388, "uuid": "ee39c8ce-b2ab-4d90-8406-d85a91496ae6", "comment": "Malware payload (AgentTesla)", "value": "a258b3163c7013119e9b9d28f039b4912e2df850", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513388, "uuid": "842ec9c3-53e0-432f-b6df-00d43ec0e0bd", "comment": "Malware payload (AgentTesla)", "value": "00a59eaf6d31855da4707389c923ceaee280e754e330a1e2de1464c8604fa182cd400fa3072f9eadfb1cefcfbdeea5f6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513388, "uuid": "97ec4e07-b736-4b44-84b8-30bd0357c0f2", "value": "T118A5D823BA6685F1C549973AC5F70C240366DD81A363F68A354A33D9097377E6B0AE0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513388, "uuid": "b8c749aa-acd8-4fcf-a917-33f0f0207cfe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513388, "uuid": "85d72deb-9cb9-4e2c-b406-3f02bdc6ee00", "value": "24576:O4B5fsjZR46VI+dIF4hojKLDWKjxXbwJbHnmmcBWn4qa+LffzK:OzaV+PWK1XbwJbHnmmci4qbfe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699513388, "uuid": "d4a3339c-e01d-4cb0-8cca-3528f9002913", "value": 2110928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699513388, "uuid": "a0c35c7b-7448-4ac9-9e90-206dbb631bea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513388, "uuid": "8bb83bda-afdf-4612-b1f9-9ef5ef508427", "value": "QUOTATION_OCT9FIBA00541\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d644bf03-7ef0-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1699528334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528334, "uuid": "10cf7b8c-0bf3-470f-aa11-5dcb93705e28", "comment": "Malware payload (Formbook)", "value": "afed79348a7ea04c2a65a5ff43788187", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528334, "uuid": "a4aa68d7-a61b-4f5d-9970-cb05402293e4", "comment": "Malware payload (Formbook)", "value": "caf3c9a44a25093ea1442f6476e3060e513742fe188e039c1e4dce7f2794dd47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528334, "uuid": "61becb17-83a6-4dda-bc9f-616897b742de", "comment": "Malware payload (Formbook)", "value": "2d5e6159d18dbf8d63e64dbd150dc77dec280180", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528334, "uuid": "f64a0dcf-188f-447f-a619-273dff522c95", "comment": "Malware payload (Formbook)", "value": "3ffa459bdd8e6c79d2cf310df85318463e77dbbb5e6f284ff519b388089acf483e3e62106b7a9abe8115f543105ec69d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528334, "uuid": "992cc68a-97fc-4101-842b-83d67b5bb962", "value": "T18C74221480D288FBC64686714AFEAF76F3778B55252BAA070B717F1C6D3324B670B852", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528334, "uuid": "7c4e8861-983a-4bbd-9319-61318da56bb2", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528334, "uuid": "155b675a-7fc1-4af1-8e85-5bafab86ad1b", "value": "6144:F8LxBsvxc4hR05SsTGTttLa1SlpywACup2rXTomkyti9gDMYtHoKgJnx:/v3kwssLGeywACuIzsItugDMn1Jnx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699528334, "uuid": "ffcc8700-ec4c-4752-868b-f2758f944884", "value": 352011, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699528334, "uuid": "63c30cd8-faed-4120-a13c-ce16cfc9dbb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528334, "uuid": "e9cd1112-4c66-4da8-bb65-924d74ad8f75", "value": "Purchase Order pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c07efaa9-7eae-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1699499951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699499951, "uuid": "be678ea0-00e7-46fc-82fa-82512160dd38", "comment": "Malware payload (Smoke Loader)", "value": "65acbf192ddef924085504f07e559ad7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699499951, "uuid": "e8cf25ca-b812-4ff1-b045-c066cd459c7f", "comment": "Malware payload (Smoke Loader)", "value": "cccc4690ace16e44f44473c2df179b5b17e27f863b33abda126199014cb224d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699499951, "uuid": "9bffe0aa-11ec-4a18-9f16-41a1eb2fac83", "comment": "Malware payload (Smoke Loader)", "value": "991ffa6fae12e521118bf1800fb9d534037c04fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699499951, "uuid": "2f67d37e-0d36-40fa-a8a3-0feedd94f061", "comment": "Malware payload (Smoke Loader)", "value": "f73dcbe77d309a34b562804565bf05bb3148e2d4f0682310cbaad25ca79e0a52ba0256ae867c51860c6aa37f1143f061", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699499951, "uuid": "750adb2f-6bba-4502-9d93-ecffd0511ca4", "value": "T1BA94D0AFAAE0AD1AC9F768354E267D561939C9D30A30D3959F8BA33C25070D382C573D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699499951, "uuid": "5dc6af5e-c04b-4504-8e70-d0837bd6dcee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699499951, "uuid": "1195b8af-1c64-41b9-906b-395965d5d130", "value": "6144:/8rkefAW3HZ4V0Kfhv/4u+EOeMKuCQ0Ftpw+TaT0e145Ep/rQTm1:HOGx/HkHKDJ3aT0K4gMT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699499951, "uuid": "0551dea3-7b08-436e-8eed-24a35cd67afc", "value": 437248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699499951, "uuid": "dfb91164-3eb2-47b2-ba26-971efed61883", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699499951, "uuid": "eff73e1a-f2fe-4b05-be5c-56415e0cf559", "value": "SecuriteInfo.com.IL.Trojan.MSILZilla.30386.95.11942", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27c54fc2-7ecb-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1699512150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512150, "uuid": "547fea55-5197-45d6-8a95-64a8de2b188f", "comment": "Malware payload (Formbook)", "value": "4a6c8b75271dfb2968fb511984fcdf56", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512150, "uuid": "92f59ffe-367c-4c30-9c0c-8bbacb225c1f", "comment": "Malware payload (Formbook)", "value": "cd1c9fad93fdc00b3d2b34bb65d84029c5a8529b7eba10b4922b503dca449c74", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512150, "uuid": "061047c7-58b1-42a7-a050-1447474f1ac9", "comment": "Malware payload (Formbook)", "value": "607a5d42b94aa5362857f893f5ff12d8fe6b7dcb", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512150, "uuid": "844519a2-5a70-408c-b8f3-5387c3199807", "comment": "Malware payload (Formbook)", "value": "61b27dcbfe8634c286e3c2972363b9e592178724d0fdd92c80f1da294346a3667919874c3711cb271b3080a93aadeb6e", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512150, "uuid": "dd7f4e21-65d5-491e-8725-2d5830942894", "value": "T14E45DF03A8408B83E41D83F56EE34EE91F1ABF04DA916EDF11197F0B3EB06725D5A529", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512150, "uuid": "60254896-2360-409a-8f19-299b89f7eeaa", "value": "24576:ouBSw6/uZyN3bVcw6/WZyy3bVuxbnpsbMHCY+eE7afAzNZr/6:D6/4Q3bVv6/AV3bVu8XYk72ApZrS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699512150, "uuid": "d133e600-eba8-4abd-8f8d-0f1dc4b36ff1", "value": 1179648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699512150, "uuid": "2636e489-40c3-4cba-93f3-bfd0d1627a35", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512150, "uuid": "4616ff95-ae3c-4f00-8d0b-2e1abd319228", "value": "Quotation.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db6e20ba-7f55-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699571722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699571722, "uuid": "102d3590-ec9f-4c21-8d8c-46f4786ef28f", "comment": "Malware payload (RedLineStealer)", "value": "97b0478ad7c74991bee97db61e3c64e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699571722, "uuid": "f452b6c5-216b-47de-836a-599f9cb86b4f", "comment": "Malware payload (RedLineStealer)", "value": "cd1e84be6809ea1ece11bb2b9cad543a5fd5f93cbed75620856ad20b70004352", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699571722, "uuid": "f7d514b5-db72-422e-a43f-98ed2afb903c", "comment": "Malware payload (RedLineStealer)", "value": "798e1f5ba71bcd01e0e9d1519e16f1e49ba5768a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699571722, "uuid": "b5259dc4-3a69-45af-be01-28a37dcf9e84", "comment": "Malware payload (RedLineStealer)", "value": "4cc919ff46999fd0fbab77439027e9dce4dca1e6a2bc6a7deecb230708ba28c5629d772b673434febf5dcafa1e9da941", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699571722, "uuid": "c5d44aea-7111-43e0-afe9-2153ce3544b4", "value": "T1B2B41212F7E85062EDF027B06DF602D30F367C958A78836A2785695F1CB36C4653276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699571722, "uuid": "1c99b392-1253-42b7-a74b-998c3a0b8e91", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699571722, "uuid": "1a8fc1f5-82dc-49c3-8ef3-ab31390bc570", "value": "12288:9Mrty90dtNHyFEWfz6MkgY8TUs2ou3+4+wSRyFXte0WtNV/cmFS+tV:YySNIzdYSz2ouOUSIRA0439Jf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699571722, "uuid": "76978a2a-14ce-4010-ba8a-fd4b1990fc68", "value": 523776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699571722, "uuid": "a6b72483-8782-4ea0-9b9e-daac3a42626a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699571722, "uuid": "0bf2007e-7c0d-4234-9400-00f9e4b560b0", "value": "97b0478ad7c74991bee97db61e3c64e1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5939842e-7f1d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699547452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699547452, "uuid": "c779d044-25d2-47a7-9b30-0a798cb624e3", "comment": "Malware payload", "value": "eade24f6ee629aff0ff09a502a598ea4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699547452, "uuid": "42e4dc7a-b626-49af-8aa3-35f24e18c1e9", "comment": "Malware payload", "value": "cd74cf1b2bb2524c9c4d70ddca0e2cc71489df1a6de1516b9c9ff2783785638f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699547452, "uuid": "0b16959f-004f-46d4-8036-52d920c42dd9", "comment": "Malware payload", "value": "8b4fe6d8a7cebae933833b8140ee80057d680268", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699547452, "uuid": "17ca7e45-5058-4081-b520-1c0fddc05391", "comment": "Malware payload", "value": "a30d2a2520b3c615a4a14cabbfe6ad4948a619d1de1e70330111ba59dcf594df2fa00d409748d3799bef757d4ff64817", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699547452, "uuid": "38db4270-9390-4a0b-9084-af5f5bfc6e3b", "value": "T13F74AF13E3D1BC3AE5661F328E2AC6E8271EF9618F15769A52F4EA1F09701F1D172702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699547452, "uuid": "5a7254cd-39f4-4378-8ef3-6dd6cc24b4a4", "value": "bdd0d029a2e2ed32505aee0758e09d05", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699547452, "uuid": "ec2838d3-1fe2-4b4d-a647-9ca7a14c4fdc", "value": "6144:yyeT9cRs4E11pSGZvAoGMOv8fMXxzSpyJrHJiimZ07ii:yt9cRs42tZvAxPEoPJlXR7L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699547452, "uuid": "8ca3b626-7499-45f0-a8f6-14760cb3d657", "value": 359936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699547452, "uuid": "c4663cdf-9c67-446f-8f09-315fa863efc8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699547452, "uuid": "f28e1613-6b79-493a-aa19-0c572e4c369b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "085f49bf-7ec8-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1699510809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699510809, "uuid": "e01abc4a-12e8-430e-bdbd-554df472354b", "comment": "Malware payload (Stealc)", "value": "41a82fc24606a8b5790dfd20aef323a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699510809, "uuid": "43be4185-1eca-42df-b349-ca93756b8f30", "comment": "Malware payload (Stealc)", "value": "ce9fbe40f5c73945c2134028fa2e40b9d9f6f456ffd0c4b96434a8fb1eb4d5ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699510809, "uuid": "acf6e85c-1382-467c-a112-f1ea6a3e1f62", "comment": "Malware payload (Stealc)", "value": "247114d23c790b260de43d8de33c19d538feef28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699510809, "uuid": "f825db9c-f383-4a0a-baf5-1379bb82409e", "comment": "Malware payload (Stealc)", "value": "00ee7bd073709268f66a24ce634a37d41ab43fc331bc773b9143da719b7b83d2a21efa30946ab0a520db663763762c7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699510809, "uuid": "dea1778a-c25e-4cbf-8abd-9ed424a4f869", "value": "T194446D13E2E16C7BE6234E318E6EC2F8261EB9614F5836AA57F4EA2F05701F1D572311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699510809, "uuid": "da1323b2-f4ee-42bb-a501-c5efbe112107", "value": "2b9afe25c9cc3b8c46fc2c8d41458dce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699510809, "uuid": "d40c20fb-3ed4-4562-b29b-f6cda632d707", "value": "3072:noLwzfh+oxEPysjvtKtdZyyi2omG1I1Nj0tfzVj9OC3XOb:nhfh+ox61vtKtyyPG9txF3+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699510809, "uuid": "a01fcd7e-df75-4ef5-b04c-0228aad88a7e", "value": 262656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699510809, "uuid": "2fa86f3e-906d-4c2f-86e5-98c2f6c64f50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699510809, "uuid": "1d3eec16-0964-486b-9116-a6649ef29953", "value": "41a82fc24606a8b5790dfd20aef323a1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cde6a9a9-7ef0-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699528320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528320, "uuid": "c029dafa-dcc4-4a93-8944-c7fcb8d7b96e", "comment": "Malware payload (AgentTesla)", "value": "d99438a2aa0bb00ef99e8fdc53705a8d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528320, "uuid": "bda7dcc0-6dbc-49eb-8ef1-576289dc0e1f", "comment": "Malware payload (AgentTesla)", "value": "cf279897e994c4af47dc13e17070577dfd362daea878c3703d0191c28f1df5ff", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528320, "uuid": "73123aa8-cce1-4bef-8c9f-36bbbc66962c", "comment": "Malware payload (AgentTesla)", "value": "1a5f2dc8479032e258810be9636c410b9fcb6db7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528320, "uuid": "ab975990-c865-49cc-a02c-ea460e8ff104", "comment": "Malware payload (AgentTesla)", "value": "df3d4bac449fafd49f055c409b4f63bac5aa666e85b988328c0b7554b12b23dadbe2b9340ed734c3d4284f3c85f46c16", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528320, "uuid": "332e747a-45f7-49bd-bf46-505fdb8b6740", "value": "T140341F037E88EB11E1A93E3B82EF6C2413B2B0C71633C60B6F49AF6518516525D7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528320, "uuid": "7edcf177-97aa-410f-871e-7beab60ad7c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528320, "uuid": "ac0e349a-abe9-44da-9637-b4a69813ba43", "value": "3072:jnklR1ZpkMYXk8bTN5mJwOFkXjs5+1sXjqy:jnklR1ZpkMYXk8bzmGOFkXj9sXu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699528320, "uuid": "aa619863-ad90-45c1-8bb8-0ef705e6a187", "value": 240128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699528320, "uuid": "ffd9a7c2-6ea6-45e5-ad4f-35c241b8a1dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528320, "uuid": "d60dddb8-5be0-47be-944f-6cc35afb72c4", "value": "cf279897e994c4af47dc13e17070577dfd362daea878c3703d0191c28f1df5ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "089a831a-7ef3-11ee-8907-42010a9c0042", "comment": "Malware payload (XWorm)", "timestamp": 1699529278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699529278, "uuid": "76c22d89-e319-4ef7-af49-30ff4123c5aa", "comment": "Malware payload (XWorm)", "value": "5d993f00ae8b3d9fd13a262b3b8787c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699529278, "uuid": "65e5bd55-d23f-4d52-8946-3eae12787b77", "comment": "Malware payload (XWorm)", "value": "cf5f6127a9facce74bc222844d2c2a084ebb19478c54a7f528e7c966b3a8174c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699529278, "uuid": "8b9e01ec-485a-40f4-a82d-a8b34fbd0036", "comment": "Malware payload (XWorm)", "value": "4d3f7a2997286a4ff0350f1ef36a79fd5ea91f1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699529278, "uuid": "434aedd1-7a9f-4b75-acbc-828d7dc92a81", "comment": "Malware payload (XWorm)", "value": "2031845599de4878e81e66cbd1751f920561091c0880613d30c646507965345b549c2c0a36e85658ce0bb5fa977152ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699529278, "uuid": "448b9df7-4bd6-43b1-ae21-82cf17065a3f", "value": "T190437D1C37A6822AD1FE5FB55CF172A2C33AF2135D17971F24C4429B1627A89CE407EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699529278, "uuid": "d03d55d6-ab64-481b-83ab-315a666de55a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699529278, "uuid": "57d6b66c-5eea-45ea-8bde-4230d2affe37", "value": "1536:F7IQr9TYlODMIceQbhzbzTg9pLO6GU3Jx:F7XrvMINQbhzb/+pLO6Z5x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699529278, "uuid": "aeb9e4cb-dfe5-49c1-98a5-0ba98fa9f54e", "value": 57344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699529278, "uuid": "0ab28e0a-9326-4ae7-bd22-c236bb99c9da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699529278, "uuid": "ce5e885c-9c91-449e-9bf1-ffbd0b0ca180", "value": "cf5f6127a9facce74bc222844d2c2a084ebb19478c54a7f528e7c966b3a8174c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "172b78dd-7ee9-11ee-8907-42010a9c0042", "comment": "Malware payload (MarsStealer)", "timestamp": 1699525007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699525007, "uuid": "87419402-be83-4347-83b1-594b03e48f54", "comment": "Malware payload (MarsStealer)", "value": "dc88dee39f74d7261ed8c191f3d55dbe", "object_relation": "md5", "Tag": [ { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699525007, "uuid": "b38344d0-8fef-4b6b-a23b-dba48cc1d709", "comment": "Malware payload (MarsStealer)", "value": "cfaca93596ee07384d3d3242f7b0b5fd18968a9011fd89f9c11a136bc48b5a2e", "object_relation": "sha256", "Tag": [ { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699525007, "uuid": "7dcbe3bf-0e6b-4fef-ae55-5754113454b8", "comment": "Malware payload (MarsStealer)", "value": "5a677cceccf21ad2ba0748f88dbe3242719f0097", "object_relation": "sha1", "Tag": [ { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699525007, "uuid": "9e8b85a1-b77d-4173-b73c-d57f793182a4", "comment": "Malware payload (MarsStealer)", "value": "1a05e66030b6f409f319974fa9c2f8c7c03d5e21743520a6e1160c32274fa8bc5264f97870135e7e0e5b3425d23278ab", "object_relation": "sha3-384", "Tag": [ { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699525007, "uuid": "69dcbe42-4160-4c4a-8f9c-b225c3a6cd12", "value": "T1436302B435311613F8D0A11E5FEBACA6AEC6061A5CECEBD8D4C76B672C087414EC60BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699525007, "uuid": "d7825b84-d894-4aca-b1c3-a01b400d7ef4", "value": "1536:pk8UZ3JX/TZ74RbF2BuxPcuWMsPrBxdmpW5O6YDPPNPYWfyb:KpZJ/174L2BuxPcD/xcArePPeWfE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699525007, "uuid": "11d1c0a6-9313-42cf-9f3b-b49f6e1c5b68", "value": 70384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699525007, "uuid": "198eb838-7dcf-4beb-9403-d5d57609047c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699525007, "uuid": "8df9e6f5-47b2-4555-b8d2-841069396665", "value": "28EB55EDA43C6679.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d69f75e-7ed0-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699514388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699514388, "uuid": "b8017f15-272a-4e25-ad77-ed60083fe198", "comment": "Malware payload (AgentTesla)", "value": "95a386c862d53fe45dd2fb13e913990b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699514388, "uuid": "b7fa2d39-8e7c-42ce-a83f-134eaca3865e", "comment": "Malware payload (AgentTesla)", "value": "d01aec0dde248e82efe215bc496318389e6de5aedff2447b9bd2067570bab53b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699514388, "uuid": "ac3ac7e9-a3e1-45f9-9fbc-6a7a6a88557a", "comment": "Malware payload (AgentTesla)", "value": "b3775e54c4fb700cc468dbde126dbcd492ae85e8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699514388, "uuid": "2d5cdf58-3d9c-4c2c-88a1-9c9ee08be37a", "comment": "Malware payload (AgentTesla)", "value": "90eabe09f3f86cdbe9cfc3278153975067a8aa6001eef48449309201c495374f8dc5b92f36ad0b521c4096eee41d98f9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699514388, "uuid": "d908cf9a-08bf-4feb-8cdd-ba63701f94b5", "value": "T1FAD43318A4000DE6FA56570275A98EE2440D7CC0959DAD937333FE6FE9B89DF3C898B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699514388, "uuid": "4b8b99e3-6503-4f8e-9316-8899beac2b6e", "value": "12288:wxIXibZ8jM1jcHvXEsoMUtdZhCxYb6vYVQ6AUx7Vzx3JZN9aPwqyn:wx4ibT14MsoMUp5uqQWXJZ2wqY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699514388, "uuid": "333510d9-b45c-42fa-86a0-bf07ce97e7cb", "value": 614371, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699514388, "uuid": "a1aefa66-301c-44aa-8764-14e1e6f70e31", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699514388, "uuid": "26b1e470-4875-4812-bef8-e32376fd22e2", "value": "Purchase Order.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46b460f7-7f27-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699551716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699551716, "uuid": "ad4543dd-ed97-47ae-bfe5-af02e94aee20", "comment": "Malware payload (AgentTesla)", "value": "53ebffed17a2a1e8131dad5a1899f904", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699551716, "uuid": "3b1baba0-53dd-49c8-a0a3-ab22907abb1d", "comment": "Malware payload (AgentTesla)", "value": "d02507545212125b0fc84de9edb463793e92c26b3c2ac2f828a556dcf23b0e67", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699551716, "uuid": "726fc732-532d-4770-8057-31d28f5195db", "comment": "Malware payload (AgentTesla)", "value": "c58ea4df728c3775a1c510aa97c9700bf35fcbfe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699551716, "uuid": "ef8001eb-851b-4366-9cf4-eae6a417fee4", "comment": "Malware payload (AgentTesla)", "value": "f010f8556686d3058c3ad8a448c3ae378edea5ae71de4b81ac90a9a3279f9f5af71de3b38014027ad7b6a895deedc977", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699551716, "uuid": "b1bfab41-c2ca-4120-a3af-c46447946e2f", "value": "T122F1B721DBE84733EA3F0379D8F31383077DE7868C46DF6E249C62596D0268059A676A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699551716, "uuid": "a57a31da-92ce-40af-9882-01c9778bc5da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699551716, "uuid": "c5e2a2c8-6fb7-4dea-a62b-a792977eb1c7", "value": "96:vRxs1bXDSn7+CO+VEL2aTwER5v/+kmp/kwSp4QJaT8FB/n1wHE7AZNHiIujSXzNt:CXWKhwWdw253Op/S4euGln1IEcZJNB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699551716, "uuid": "1ed16fb2-976c-4681-8559-398610062c24", "value": 8192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699551716, "uuid": "dbab0b51-e72f-46cb-a19d-fe7ad318063d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699551716, "uuid": "1a1562b0-5d5a-4f01-af9a-21f32457b6ef", "value": "whatsapp_images_111000011723-000xvtyy_ztt.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41c3b6a7-7f55-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1699571464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699571464, "uuid": "efae0033-7d61-42e3-a11a-272fed33a058", "comment": "Malware payload (Mirai)", "value": "bc403872ebf37e65c3b9d88385b4795e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699571464, "uuid": "e81afc0c-dc39-4910-bf25-3a55d8166073", "comment": "Malware payload (Mirai)", "value": "d1b20e1afb31ab7567db277eda31132b4d52800291b03a910824238c864038c4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699571464, "uuid": "4f1ad8f2-d332-4936-862f-1f59cfff2a0b", "comment": "Malware payload (Mirai)", "value": "ae486f150f34cad3adaae6a9beec962e5cecd0a7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699571464, "uuid": "6d9d42b6-aed4-4527-9620-11540ec68a8b", "comment": "Malware payload (Mirai)", "value": "eceda6cdfd58f9183479dfa1a35c7c1bc8238bcdf4c123fa5bb97cf38bac8f34cdab948047978a714383570d69152c69", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699571464, "uuid": "b6bdf9b1-9dca-4b65-af89-cae9e43253dc", "value": "T1A9635C02B2280A47E4931AB0253F1FE057BFEAD025F4B685695FDB568635E772086FCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699571464, "uuid": "ce165b6d-a620-4bfc-ab3a-1ba47a8527b0", "value": "768:BcM3+VHuQYRPbMlxkSC1yHyx4cDjPHb/1ZsV28uiFzy48qHH5eKnsbmqtr4sGZMP:Ow+fYYC1yHya2z/K15mtEsfkIWwDRI/U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699571464, "uuid": "2684d318-f22c-47f2-8047-035d78887c7c", "value": 70744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699571464, "uuid": "a0eaf02a-ac86-4373-af52-2b76b7c14bbd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699571464, "uuid": "9b0cb2f8-0827-40fb-94b3-80fcba94dd2b", "value": "bc403872ebf37e65c3b9d88385b4795e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "394a4a9c-7f00-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699534943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699534943, "uuid": "bd0c5cbc-aa48-4516-bf0d-e5032dcb0bd1", "comment": "Malware payload", "value": "e3783031035e8dd43dd2694e077fc401", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699534943, "uuid": "b7f59710-5903-4476-9ca3-d7548dd5eea1", "comment": "Malware payload", "value": "d325b626866db7620369d12d53efec46babeabe7cd2be3869943f74bc9cd1720", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699534943, "uuid": "b4a44ce4-5782-4244-bd7d-ee855cccc59c", "comment": "Malware payload", "value": "01c25d8bf97c749e4631df88b9515b16ae9f2dc1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699534943, "uuid": "09d35ff8-33e1-47bd-869e-95822edc3ccf", "comment": "Malware payload", "value": "fd81c806ae85a5b606d4232ef710a3aa0d09ce04a85cc434557fb1cab8ceda1c6901124392c52bad39673e3333a29d12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699534943, "uuid": "03daca33-3b36-4bf0-a67f-a75cf7a5d9e0", "value": "T117F59D217BD18C35E2B33231856DE379A6BABE306F758A8B11511A3D2E345C2593C73B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699534943, "uuid": "93939963-0fa7-4e46-947c-f7b382ca0db4", "value": "1808bf6dae531b63095d6e441d4dbaf2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699534943, "uuid": "ab1f8b25-60c5-4bbd-b728-109423213bb2", "value": "98304:0rzi2j1z73pcO9s75GmJRfdlSN6Zk/dztxQmsw6J7RmVWK3RYpQe74:QVIGIdlCtZszmVWK3kQe7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699534943, "uuid": "4effb7d8-bc91-446f-8df8-211f7d23084a", "value": 3649024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699534943, "uuid": "4a4f7008-3f6e-4f49-b530-ab3c885b295e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699534943, "uuid": "9d711643-b873-48fe-b617-378365aa405b", "value": "d325b626866db7620369d12d53efec46babeabe7cd2be3869943f74bc9cd1720", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dc71b44-7ef6-11ee-8907-42010a9c0042", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1699530602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699530602, "uuid": "65be55a5-c7b6-484a-ae59-30af4bb6d6db", "comment": "Malware payload (AveMariaRAT)", "value": "ce0e864a2605c6594fc60526e5e49b0d", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699530602, "uuid": "4efa1fda-5285-4067-bfb3-6fa558b16cb9", "comment": "Malware payload (AveMariaRAT)", "value": "d41a980c0f1c918ef3a5f0b17ee937befbf9d63059edc0eb9e1aedc40a8d52cd", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699530602, "uuid": "9dc245b6-e20e-4437-82d7-75af079ef8c8", "comment": "Malware payload (AveMariaRAT)", "value": "cdc66180f41527f7f180abb44df781963eab6a22", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699530602, "uuid": "58d210b8-d594-4e2d-9252-232b5e6f0112", "comment": "Malware payload (AveMariaRAT)", "value": "24ad7610975559740b299525cdf30b87b5f5e6e56331b324b941de982cd4d850fad61ec4e96acb1ac8d04060a0023793", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699530602, "uuid": "fa8ca14a-7b1c-47b7-b4aa-767f6270f4b7", "value": "T19934F1292389CEBFE3800071E015D5F16A35CC7ED852E713459DBC28FD32AA89997DE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699530602, "uuid": "f371385e-69ae-4f13-a13c-e9c3441fd6a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699530602, "uuid": "d4696f63-0585-41c4-9c25-4ff345935a75", "value": "6144:29m9cK8nFybp7PuCWyJGV+erK/FziwBP/DGDMDSj:i/gWyJZeGJTPrGS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699530602, "uuid": "5492b15e-637f-43e3-ae65-84488376fbc6", "value": 237056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699530602, "uuid": "96516003-2dc7-439c-b959-8c8b8b2c9b63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699530602, "uuid": "018e08a5-dcca-4bd1-abe2-1c1fd93938e6", "value": "d41a980c0f1c918ef3a5f0b17ee937befbf9d63059edc0eb9e1aedc40a8d52cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "075df0e0-7f46-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699564924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699564924, "uuid": "cbe64fee-a978-4caa-a710-3a63cba196fd", "comment": "Malware payload", "value": "f93a5e637116bffdb3b812b2bd8aee78", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699564924, "uuid": "6447584f-ad34-47c4-99a4-eec5d7aa4ca5", "comment": "Malware payload", "value": "d4b2632906807cd90f9747c1b6c03c6933ccdcf012bddd80e40e2f0c94097b30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699564924, "uuid": "abc78efb-9496-4ccd-8045-e2f39ebb6ef9", "comment": "Malware payload", "value": "c756dee7d13f257c9e602bb0e51c2acfbeba8615", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699564924, "uuid": "01ef67aa-a344-4a3c-96f8-1f18b4e9c3ed", "comment": "Malware payload", "value": "cfba7eeb75e4d8aea59a2654f4a28fcd4040201589f456d40d78c106895686a386801599aba8a686deabe47be9660d61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699564924, "uuid": "bd0a51ff-f6d8-4f21-90b9-89bd21011c52", "value": "T111057C43F6D384B2D325153009EA773699789B240E31AEC7D3A1EE7E6E7A1708D37219", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699564924, "uuid": "703f45a3-0def-4c51-96a3-cf6f8a0d5903", "value": "cbab264a14ffded93674462876a9ee93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699564924, "uuid": "68ab5042-70e0-48da-9ea4-adda10eebea4", "value": "12288:xP9NEzrF7DDmDaC5V9hWBa+CrvBVEPPbdBiMjc0BWnlqqz:xP9NEzrFPDsO1CTBaPV40/w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699564924, "uuid": "1740f126-4eaa-40d4-b972-d069d608a65d", "value": 815104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699564924, "uuid": "fa48c0ca-b585-47a8-a1c6-662110b6facb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699564924, "uuid": "b2492b21-a5c4-4109-8625-6591c31b5399", "value": "SecuriteInfo.com.Trojan.PWS.Qqpass.9498.21277.15477", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16c1c50a-7ecd-11ee-8907-42010a9c0042", "comment": "Malware payload (PureCrypter)", "timestamp": 1699512981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512981, "uuid": "65d5e34a-ebdb-4ab0-9437-feefe71ed7d7", "comment": "Malware payload (PureCrypter)", "value": "ef5f1364ef58d3fcc83ddb539b096477", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512981, "uuid": "4f3258d6-83e2-474f-8e64-512d41e04035", "comment": "Malware payload (PureCrypter)", "value": "d4d91c97344ed206aae94943a56d843d9c07a1085f74b413ad5463423a93e131", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512981, "uuid": "4311f8ee-5128-47c1-8d41-7ea2a93bd140", "comment": "Malware payload (PureCrypter)", "value": "0fab5e908baff1fd7e451e6a803656bd7cb67536", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512981, "uuid": "4de83ec5-c2cc-4f02-b5b1-eebe712ddc56", "comment": "Malware payload (PureCrypter)", "value": "0046d3c47b85a73ab41e22092cdea9c8bb4159258255c4d0e019f02cf181eeddcc70f482dd859b4cee256bae6fa918a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512981, "uuid": "35c3b1e9-5dcb-4806-b4ba-9ffd16b6997b", "value": "T1CB22F9906769EAD4C46117BD9DB7CB622A38B626E8485F0F35C5730F6C033661433B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512981, "uuid": "6bd3c02d-d241-4755-a19f-05f2df90c9d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512981, "uuid": "082d0f77-004c-4f84-a31e-ced4f62e340a", "value": "192:jUvv2jaftRuL4dwudLRZfiiLX2HS9yxSyrsRt8G3mSF6zEdst:jUn2Qrdwuljiiay9ycyrsR2vZAds", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699512981, "uuid": "742cb97d-8394-4a5a-a8bd-6cde96ded484", "value": 10752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699512981, "uuid": "810abb48-8a2a-41d8-986d-f5cba6162bf5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512981, "uuid": "ee3e00dc-8e37-40be-896c-6e8b265617e0", "value": "Product Design 2.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38ef7494-7f55-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1699571449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699571449, "uuid": "de7d3146-7c5d-4147-a5b1-3a6177bafed4", "comment": "Malware payload (Mirai)", "value": "7dcb9839f07740fd354ba2164d2ebc1c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699571449, "uuid": "260cc19b-ad29-48d4-bd72-80c079372829", "comment": "Malware payload (Mirai)", "value": "d519e668aa50586d27abe045a7291a580fb72288eb7fc070291460ec78c74941", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699571449, "uuid": "73be8578-69c9-4784-9a48-747056b5daa0", "comment": "Malware payload (Mirai)", "value": "e9c09ee8f9116a8d4c6d6e9b0cadacb371315dd8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699571449, "uuid": "e6fc519c-8175-4907-b842-1ebb9184106d", "comment": "Malware payload (Mirai)", "value": "2d3af4a95a00a4d91b218397ae216ea9b24d76c52e953bb13ceafc6da57619123ee3f0d8355357e35f2f8e70cdabafad", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699571449, "uuid": "e2180051-2dd8-49c8-b4f0-641538bd90fd", "value": "T13F330991B9824E6AC9D513BBBA6E55CE332063E4D2CF7353D8201B543ACA51F0E6BF41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699571449, "uuid": "5ab0fe50-b081-44f7-b8a1-f8bf88059973", "value": "1536:/+6AkY6wggbL6DCgz7P7BWy4LpEyT1maBy21TNA:BxwgKLAC0r7gzLuyT1Rs2VN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699571449, "uuid": "eaeac6f5-83b2-4f2c-9ade-2e6f923e699b", "value": 50800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699571449, "uuid": "9c051f2f-e000-4e90-915c-476f72c3d5ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699571449, "uuid": "422f9e86-05a2-494d-85a1-cd8a6ee4e016", "value": "7dcb9839f07740fd354ba2164d2ebc1c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70d8a83c-7efd-11ee-8907-42010a9c0042", "comment": "Malware payload (Glupteba)", "timestamp": 1699533748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699533748, "uuid": "afd7c0ed-2ada-4869-99fa-114988908626", "comment": "Malware payload (Glupteba)", "value": "9acf5751d05a261a62aa928e3796d81c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699533748, "uuid": "6b159eef-63f2-457a-a6b1-cd8505407799", "comment": "Malware payload (Glupteba)", "value": "d56792563235750411ef4841e1ea37039a5db2a8810146734112bb0e11ff366d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699533748, "uuid": "3bcfd653-1ee6-4430-af86-264e84ac038d", "comment": "Malware payload (Glupteba)", "value": "13d1373d860140cf8df49f5f79c782a29d31356b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699533748, "uuid": "b5c6955d-f647-4d2d-b50c-a1d3bc64211a", "comment": "Malware payload (Glupteba)", "value": "dcd1ab03e8813e3b818afd6d3398f5768aa3ff23f020ce63283834a26522ab172e4d2b2c7433e0575e048b7bca2ab976", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699533748, "uuid": "322e9606-162a-46a3-89cf-70f8b77913b2", "value": "T12916330173F27C95EA721832A4699AB9733EF9206D6C726B2715C72F58B80E0C7B7345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699533748, "uuid": "7ccfeba2-89d7-4518-a695-8043e78708e6", "value": "7f5ebfefac7f02e8617b9aa5659c8d4e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699533748, "uuid": "91ab4743-ee81-46b8-8a14-e8541d356d90", "value": "98304:Umw1LPDnxxF+Jqv82oqnb20jW7y9i795h4PUaS1EdSCrvUqdsW:MJn1h8gj59e9U61EdR1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699533748, "uuid": "9f81c37d-dc41-4ad2-891c-d6c9cef795c3", "value": 4390256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699533748, "uuid": "8ceadb42-265c-45cd-9897-f13ca01b512f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699533748, "uuid": "a72cec50-c53c-411a-9232-1637aedf35ce", "value": "d56792563235750411ef4841e1ea37039a5db2a8810146734112bb0e11ff366d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f76e468-7f19-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699545825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699545825, "uuid": "c8d75f40-43ae-4917-8f1c-155360b1a030", "comment": "Malware payload (RedLineStealer)", "value": "afaabc45361e7ec8636707e81ac84f17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699545825, "uuid": "9b5dcf4c-3c2b-4d3e-a4f6-a54bc4979cba", "comment": "Malware payload (RedLineStealer)", "value": "d72bed595b6636bbecbd227f24a83b8aad0ede6a65193edf22b83748133c4086", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699545825, "uuid": "ff3ca8c1-ff5b-4e52-a75d-f9e92c863807", "comment": "Malware payload (RedLineStealer)", "value": "572989f6c056f6567c58421907b92726c3ea00d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699545825, "uuid": "a88f4e3e-b531-4f41-a32e-e0d7d60064e7", "comment": "Malware payload (RedLineStealer)", "value": "ba831778cb3570f98f843869d8d050611aeff72d3857df5096267765f59b893bf6fdbfa977d46efba3d68412be089c21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699545825, "uuid": "492c03df-5432-4dac-b6f2-a40ed4c4ec1d", "value": "T19A24E72AE344551DE83E433DB41C38709F707C52E16FE32E95BA7AED683BB498A105D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699545825, "uuid": "4c631771-284e-46a3-88f0-828ade2a3a4c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699545825, "uuid": "f837d489-9800-4e3f-975c-bedbfcd45762", "value": "3072:wriBOoEdL71Ngc7K9DrvUNgmRSdks1B4weY+aKSa:wrwrCL71Ngc7YrY06s1BJj+F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699545825, "uuid": "9147ab94-8956-42a2-9ca6-c69d7cfe514e", "value": 224768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699545825, "uuid": "9c8406a7-638e-43a9-94da-b5a309a835d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699545825, "uuid": "c01d6eb5-16f2-4a15-93c2-ca74dc9cc98b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "470beb46-7ecd-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699513062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513062, "uuid": "cde2d2f2-005e-4d1f-a02a-ed4295c61315", "comment": "Malware payload", "value": "3ac4247262947e54eb583e8c521a2cea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513062, "uuid": "22580e68-563b-47bd-9791-a6e1b9b32569", "comment": "Malware payload", "value": "d7e7b925ac0f5e057562c3229d4b9e4a88fd28b50d975a1511316a7604299809", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513062, "uuid": "bdf0ee14-b8b3-47b7-9d09-311635d6d456", "comment": "Malware payload", "value": "7848e5c1f3edd94172a9d66026e59292d5ce1162", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513062, "uuid": "447ab781-c678-4f56-a835-cbba9a348940", "comment": "Malware payload", "value": "6f0c8695b0b6e1e35c26af41308a7c40a5483b7820e8b89ea3c722ff32add4e465ac480eb723a6845de457481c0bc03d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513062, "uuid": "5a2340ba-10b8-43fd-a80d-cd28c0ed44b8", "value": "T1F6832990EA8C97A3D7AE27BE657243512BB4E6D2B101F74F6D9C35C81C433882C157AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513062, "uuid": "c69f8671-3079-4858-b120-09a1afffb97a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513062, "uuid": "ba69637c-b143-433d-9c6f-d6c6f0d26864", "value": "1536:YNGsfO67aUsTJ1SjuBshlaSaqaGMJ+IDwpRQwImTRaAAVvvm:YN5l3WsjaTFTb0RxRJYXm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699513062, "uuid": "fd028deb-0dc3-4c66-87b6-f73898e48171", "value": 82944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699513062, "uuid": "a81dd77c-889e-46b2-8e49-da673dc040e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513062, "uuid": "e39ceecd-443f-40ea-bfde-26bce8b8992d", "value": "Product Design 1.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d43f19a-7edd-11ee-8907-42010a9c0042", "comment": "Malware payload (Heodo)", "timestamp": 1699520024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699520024, "uuid": "2bb37e29-aa06-4e14-a721-b67dd244ac2b", "comment": "Malware payload (Heodo)", "value": "5ab2b28bc1e00519dcd55b67e9198c2c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699520024, "uuid": "f28abd7b-7062-4dc5-bf29-987020d09a38", "comment": "Malware payload (Heodo)", "value": "d8ca36406bfacdd794cc8bbc54f38b1c88116f1a180d4d069c3ad4a2210ef2f4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699520024, "uuid": "35f34005-a6f1-49a0-b215-7ff39d85a56c", "comment": "Malware payload (Heodo)", "value": "0b983184cf9e27707b80635e4ad5b0ea88de3bd6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699520024, "uuid": "12dc974f-cfef-469f-b47b-a55b03e31765", "comment": "Malware payload (Heodo)", "value": "7e4c80e7a30fb71478f8285b8ae88ff778a0632c84c5700c05802d9388f049ed359fd691e82c3fe643b3989c1827e1a6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699520024, "uuid": "aa80903a-5393-4ae2-b983-ddae70f57f55", "value": "T17564E94352D37C55EA26CB328E2EE6F8771DF9518F0BB7A61219AB2F04B11B3C162711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699520024, "uuid": "64b7a2be-9a1c-4ac8-8ff4-7183c30237eb", "value": "b7e07a5800cbc9c6f303fe6cbe1b23f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699520024, "uuid": "9a580e8a-3644-4f80-8bc4-6245497c8167", "value": "3072:zJ8mQMJRcw8aHouM4QUW132bFGzmYvrjBv49kgN9GAHsEz:L1JOJkouM52bUDBg1TLH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699520024, "uuid": "a571c44f-a5ea-43ee-b5f2-246dae4fb5ca", "value": 331776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699520024, "uuid": "49d75e67-4d17-410d-a6b4-2f3ce140862e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699520024, "uuid": "3dfa9e2b-dcbb-433d-b567-a3d97dbdac91", "value": "5ab2b28bc1e00519dcd55b67e9198c2c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09c0c1fe-7f46-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699564928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699564928, "uuid": "df7424f6-8119-407f-9f86-120b1dd62022", "comment": "Malware payload", "value": "148bdc61baecf3b3215945d57177acfc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699564928, "uuid": "44d78fc6-e5db-4a28-8044-a3f07d2aed7f", "comment": "Malware payload", "value": "d90b02082280fa42993fc5b16e6d358df709d2b24285f66de653afd7ede28176", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699564928, "uuid": "a7f121e3-c987-4964-a906-021cd86e8f5e", "comment": "Malware payload", "value": "18cc898bc61a0bc1c222139642cf57de67ef12c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699564928, "uuid": "2300a4fe-4782-44e4-b260-d55f39d33565", "comment": "Malware payload", "value": "b658a779b129c42171d36af1b0b827c64e799e52a48a02a8c4008ab302a2b11ed788291cad0bcc6a05511a756bdc6cd4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699564928, "uuid": "477b57d0-349a-4d84-9c9c-f090a2c4a9ff", "value": "T12DC4238B6DFAF5DBF091DF3A1637F0B16508D23DB45803DE6A4BF237A2871A56682404", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699564928, "uuid": "47567cef-78f0-4f7a-85c2-67ac202f2376", "value": "2b07ba9c1e54b04624dfdda69d875a1d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699564928, "uuid": "8ce892d4-105b-4744-921f-35475c32e816", "value": "12288:bL3SG3vLUZ+aerv0MiC+G419pQR7Rj/ybCiblEAxL1F0:akLUZNCW19pqdGlzZF0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699564928, "uuid": "5e19a494-4fc9-4215-a14c-9d8f7b6fd58b", "value": 582605, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699564928, "uuid": "ad02140d-8e89-47bc-b8ed-b1da76e559a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699564928, "uuid": "c709314a-19d9-4b0d-8d81-085b8e634304", "value": "SecuriteInfo.com.Win32.Evo-gen.28136.6803", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b85796a-7f26-11ee-8907-42010a9c0042", "comment": "Malware payload (Havoc)", "timestamp": 1699551348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699551348, "uuid": "1271ecea-d224-4480-9cae-64ce7dc3e130", "comment": "Malware payload (Havoc)", "value": "956eddd55413b4c5631b8bf4f34a67bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699551348, "uuid": "cccf0cef-ee9b-49a4-bf33-25eb7d79712a", "comment": "Malware payload (Havoc)", "value": "d9881976aeb8feccc000633f650219fbc5b794b7046aa3f30b5d0b4388980fa9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699551348, "uuid": "b8d4a418-87a6-483f-bb24-09c701644716", "comment": "Malware payload (Havoc)", "value": "cf76f2d2e907500ec6726846a4d67b20e3332fa1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699551348, "uuid": "b5ebb1ca-a07b-49ad-9e2c-6937d89d05e9", "comment": "Malware payload (Havoc)", "value": "63e1d236abe8fa0d3123775c33ebd21398456a04209d4629ecdec9e5a17c7173cf780bbc6c3c62290781318e6a4826ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699551348, "uuid": "5ef6c849-9994-4a38-ad10-c2ee3bcfe692", "value": "T19F54E1E4A51AEC9BF3268038D524FF5889D91195E71B907AB021E7B941F33C0259CFEE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699551348, "uuid": "4b898fb5-c04a-4217-8ad8-60cf226b82f1", "value": "9acd7e36fa5274dc59da49e397729cba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699551348, "uuid": "dc5dda49-13a1-4841-b43e-87486fef57e6", "value": "6144:oSqZ0fmjk0DNzEI2754Pp9flHJN0UvWXNrVtNKsnix2Fmf+G4BhA:GZdj0nVi9fXN0wWz5ix2EWJB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699551348, "uuid": "baee4eb7-a6b2-4192-957e-1ece09a258e1", "value": 297984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699551348, "uuid": "fad26791-d0fd-4b03-b3c5-8573b0ebb02b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699551348, "uuid": "c25877ab-1d7d-4105-abba-adca595860f3", "value": "out.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ff32bb8-7ef0-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699528082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528082, "uuid": "49b1ee87-5e2b-4e5e-901e-057a8f1b1cd3", "comment": "Malware payload", "value": "8bce77715dbc741af33389a01ab07125", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528082, "uuid": "b311a1bb-6da8-41cc-afc2-ddd4040db58a", "comment": "Malware payload", "value": "d9d520a375b01a74fdb9b1acfffa6f4520211474df4403c821b8bec07d0c66db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528082, "uuid": "e2a24d71-6b71-4b81-950a-f54ae23a4361", "comment": "Malware payload", "value": "25c3043cbeefacb84e41f21851e58801f07b310e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528082, "uuid": "371c0817-1487-4ba2-8598-5233380463c8", "comment": "Malware payload", "value": "afbaf4a24cc47551b5bd4544e557c393c4254ca68f807a32b416b0533bbf8f3f7b58dced61ddf23634a08d99e17a8acc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528082, "uuid": "7d592021-87ed-4674-bbec-8c41ed8df734", "value": "T10F84F4573F327484F86455306DF786FA7792FC8C4E27414B1B20366AAEEBE222D24253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528082, "uuid": "5c4df5cf-38ee-4716-9567-576ddc6e7350", "value": "9707143f55c4ddbc883edd7beb312d9f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528082, "uuid": "5bba6c06-82b5-4dca-8cae-6dc3a95bec36", "value": "3072:/UQV9lA0tQ9nLHbB9WHCS0AgTlhsp3mWLCZpnLJuOOyZ:9i4QxL7B9WHK9Jhsp3pCZpnLcOO2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699528082, "uuid": "d6a73744-6839-444f-9e7f-83487ea8c280", "value": 397312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699528082, "uuid": "822104df-8e79-4522-a430-05cb7f92dbc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528082, "uuid": "24c859c8-28b8-4b19-943c-1f9857763e9e", "value": "d9d520a375b01a74fdb9b1acfffa6f4520211474df4403c821b8bec07d0c66db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c170a443-7f04-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699536889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699536889, "uuid": "e9ecbc13-c3de-46da-ab41-28860c244f6a", "comment": "Malware payload", "value": "513699aa06f86c1060974a70f901a11c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699536889, "uuid": "f74b22ec-83f2-4352-9500-33f61d24d6c1", "comment": "Malware payload", "value": "da394b257133646e423b0378af136301a79d1ad8fdb0a1c52ea1c97d855e67bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699536889, "uuid": "078d33c2-76e9-4e33-a01c-426e644a6bab", "comment": "Malware payload", "value": "4a341824a08d1ddb9ada6804cb9cb4d9928f9011", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699536889, "uuid": "ca2b6de1-8bf4-4523-94f5-2816af9ffd35", "comment": "Malware payload", "value": "2b161b5867d83d6c403e1ae2f9965a447c4e2348b4f26e969d393673546e2f6be0537d02e731d25a0953df984e3e0f2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699536889, "uuid": "969a706c-6f83-4030-86ad-462230ce5a57", "value": "T116959E02B7C280B2D5C505B672AEBFB95D782F20573298C7D3C83DA54A74DC1763AE1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699536889, "uuid": "2a842184-f6a6-406c-8cf5-4b58579ac50a", "value": "a0fa20784f3fd3dda969922ac083221f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699536889, "uuid": "84a9b724-ed69-46ab-a6c1-2c1bc24ceaad", "value": "49152:GRzMxx/5nfUZW6/N/aS2JKs8sPKEuJI7qFpGxmFySWz3oujN:GR+BnfUZW6p91JIt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699536889, "uuid": "d07f5b50-268e-4588-bc07-fe0573b8cdcf", "value": 1891688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699536889, "uuid": "8939a566-6919-4b84-9709-aa497f6f0f59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699536889, "uuid": "cfeaf8c4-2ea5-4aca-949c-72dc796ccfb7", "value": "da394b257133646e423b0378af136301a79d1ad8fdb0a1c52ea1c97d855e67bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c150b3e-7f5a-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699573710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699573710, "uuid": "e519fcac-8a15-4f7c-954b-ba80b17da14f", "comment": "Malware payload", "value": "7bea9f5372aab94d458d5048c0a340aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699573710, "uuid": "46e3768a-70da-417f-a865-de2b5b376525", "comment": "Malware payload", "value": "da865b4ff803dbb197464b64ff5724ee6203dc65a6d5dcc22295aca93a2d98f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699573710, "uuid": "377ec198-8a62-411b-a4c0-372dd1bb8e40", "comment": "Malware payload", "value": "34260bc7e6bc3cc6f6c194e03b4acad60b62a4b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699573710, "uuid": "af8e9371-8a51-4950-980c-4f38a6d20a9d", "comment": "Malware payload", "value": "b2695777bdf4126750fb4202caadef5dab433512c2974e91bbb91768b71a773fdbf377a5bf5f7d177b9742aa4a2c67dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699573710, "uuid": "12ae86f7-d3fe-462a-ae45-d5633d6201ec", "value": "T10FB41212FAFCD062D9B517B059FB02C31F323CA5A538836A3389591A5C736C4AA7573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699573710, "uuid": "261385fa-4943-4bc9-b91e-302268c93709", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699573710, "uuid": "e434affb-e6cd-417d-90f9-3c1941e5abd4", "value": "12288:+Mr4y90rIKFyz/NsEY8TUs2yuB+4+wSRbFHdqPRqurN:eyAFyiEYSz2yuUUSFbqZqo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699573710, "uuid": "4c9b8d3b-8d13-4587-b0f4-2d5def764d1f", "value": 523264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699573710, "uuid": "b4365d0c-7c08-4640-bf61-2a2f8d48344d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699573710, "uuid": "cc3b73b0-f985-40fa-a5fa-5f677c930883", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97cb3982-7f47-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699565596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699565596, "uuid": "b92fe426-98c0-4e62-820b-e9e5c891fa23", "comment": "Malware payload (RedLineStealer)", "value": "08d14f9715fe88fe5260096942b4dd51", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699565596, "uuid": "80b0ecbb-c611-4bda-a6fb-497d7b8561cd", "comment": "Malware payload (RedLineStealer)", "value": "dab0e67f3eff66cbdc1b3d12e26b50a5e76c736935f755dfbea422b6e3976f88", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699565596, "uuid": "e9fdb299-4b45-4c3a-b751-7065c6c49692", "comment": "Malware payload (RedLineStealer)", "value": "a686291dfff855a8502cfd8a8f99effce3186101", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699565596, "uuid": "2a5d2234-2464-4630-aeec-daf8b21d6444", "comment": "Malware payload (RedLineStealer)", "value": "a2ce3fb2e0ee88c6b87422063e19a45c0a78cadb603b3303390714f38278b37a565b6864f4011c2ef01ed9e0a352e756", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699565596, "uuid": "87502db7-1536-4d86-9f35-e4164f5c8e41", "value": "T13F44077C9EB010F5F9F81D33A8DDB8522452D379ED04A93B314249BDB8BCA92F1AD215", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699565596, "uuid": "72e1aef8-4cef-4581-9d92-238c74f039df", "value": "2a1150fc59cdc388310adf95949dde6e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699565596, "uuid": "e780dc5d-f03b-4db2-a1ab-ea0e16f6e503", "value": "3072:o1Gy7Uik1+ASTqaVjckuh7Pj4k6n85hRMoVkzXmCUMTAHO47:oaSTqaVIkuh7PjTH5hRpNHP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699565596, "uuid": "0167fcf7-7c71-4629-975a-4381cb661c71", "value": 276940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699565596, "uuid": "3056d6e2-6432-4554-a399-cb76429f8303", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699565596, "uuid": "9b6988e8-2d6b-4733-8074-9966b3c48647", "value": "08d14f9715fe88fe5260096942b4dd51", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4513b4b4-7ef8-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699531527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699531527, "uuid": "cd69c407-ce3f-4ad6-8f34-89ed79ea0175", "comment": "Malware payload", "value": "5d58695acb55f560100319ef85757c7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699531527, "uuid": "9e7ffd0d-895f-4588-8d19-aa61e7c490da", "comment": "Malware payload", "value": "db386c7c602e676c65aca7a7aa5e074acfae585caa9a9c93fe1a8dc81e03696a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699531527, "uuid": "1b942c54-9c19-4b5e-937f-35ba887d0a9f", "comment": "Malware payload", "value": "6292660f3f94a471e1ec239d2487319ad7d7ba79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699531527, "uuid": "66e6803c-e0ae-4d7b-8319-2aae75e04a16", "comment": "Malware payload", "value": "80d8f33cf7d12ce82f3ac280237b6456223c14d56c0d842ae93366256931b92c945cdb2e8cc7f98db56d731586b3ae42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699531527, "uuid": "78e39452-02bc-442f-936e-e71521e399b1", "value": "T185F4E11AB3A50DF5D477817988965602FB7278560730CBEF03A4862B9F23AD0AE7F750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699531527, "uuid": "5d11595b-0a44-43de-b9f3-9d94e2cd3e0b", "value": "1b61d7406843acdf799e1b6b98476a0a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699531527, "uuid": "a8dc9ea9-8d61-4f80-9b54-bc7440bc8ecb", "value": "12288:dytbV3kSoXaLnKos+8HPDM1ktoOT1OtXiHyhro6reu6w3yzGM4D3PQbka:cb5kSYaLKV+8HPDl9bHeMVGYGMY3i1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699531527, "uuid": "3ff18cda-6cdc-48c1-8b6f-7d74045f3b83", "value": 742832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699531527, "uuid": "d63fb292-4580-4d1c-840f-3a76000690be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699531527, "uuid": "cb42356b-a1f2-43d8-9e5a-af9a915ead3d", "value": "db386c7c602e676c65aca7a7aa5e074acfae585caa9a9c93fe1a8dc81e03696a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f75d8b62-7ecc-11ee-8907-42010a9c0042", "comment": "Malware payload (PureCrypter)", "timestamp": 1699512928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512928, "uuid": "02e061f6-f481-4f52-ad7a-0cec41abe0d5", "comment": "Malware payload (PureCrypter)", "value": "2991820b80a0e4bb80c5836d0a566be8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512928, "uuid": "a409e249-953d-48f8-88ae-2068d2a2182e", "comment": "Malware payload (PureCrypter)", "value": "dd5b13e6464cd6c24f1526185ec693ade49d8d317241e1ae256713444999d71c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512928, "uuid": "156a1d26-93b4-497c-9a3d-a43dcb4ac5d7", "comment": "Malware payload (PureCrypter)", "value": "2bd22584444b737ab8c9ff6b4a157d57247e27b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512928, "uuid": "edac08a8-5368-4f92-ad3e-0c3e36839ada", "comment": "Malware payload (PureCrypter)", "value": "b5876e8833083e0f1a50a03011a2710263d6a9eccc2e8e7b923edd8be66c55cbe82098ee278e5000eabb33139c5e0e02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512928, "uuid": "6f79fae2-dcd2-41bb-95df-5235361cd2a2", "value": "T1C6E24BA6F65E8590C2554F3DC4A78880C366E1CBE4A3DA3F758F63462843FADE435287", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512928, "uuid": "13cf31a0-d335-463e-97fb-7068d801be7a", "value": "768:nFNVAhxXhmcqIjGby3Deoy4hiaygycyrsR2vZssR:fVA/RS3EYaavvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699512928, "uuid": "66251a88-9a38-4b04-97c1-8a4ed550b063", "value": 31232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699512928, "uuid": "6c17a41d-1623-408e-9010-935a579df1c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512928, "uuid": "d0f35f1c-1dff-4cbd-8c7f-321a5d5bde3f", "value": "15546 - CHIPING93.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5974c630-7f1d-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699547452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699547452, "uuid": "64d7a49a-3e67-49ed-9b48-c0e61c8d54f0", "comment": "Malware payload (AgentTesla)", "value": "773844ef9327611f2973937b5b8a4757", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699547452, "uuid": "016b08f9-d923-441f-8fd3-a44e3fb07910", "comment": "Malware payload (AgentTesla)", "value": "dd8dcc78210e4be4120b94349a7e71a21982e4a9b94c0b676140b3a939126548", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699547452, "uuid": "22727251-c924-421a-8c7a-9141092916b1", "comment": "Malware payload (AgentTesla)", "value": "288915aacd97d8a4c4965182feb06768c0aa02a6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699547452, "uuid": "23cee36e-ef9a-435a-a7e2-2511ec9ee7f0", "comment": "Malware payload (AgentTesla)", "value": "36eaa9963a220fb04746807490f1b2827eddeacb146fbf68e5f9fd415e2be48309ec32e404c33134ced3b3c732fdbc9b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699547452, "uuid": "46df8423-61fb-42ab-9050-4df37616ec71", "value": "T19EC4232CB82B4384FEFF05E422064A8EC15EADE72FDAB09646425D6551E03ED2789D37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699547452, "uuid": "07d71b41-f0c6-4c64-aab6-5dc6949c284e", "value": "12288:Ajo6vrh1Boic2XxaudzobNQ0uTPD7DqK0nX1SSVzlF9CV4L:qoOh1BoAvdGjSH2BXbVzlTCqL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699547452, "uuid": "2bf96d32-5414-4839-9011-e1d58c64b350", "value": 585445, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699547452, "uuid": "a2d5457f-93d2-4edc-bc3c-9588de165f7d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699547452, "uuid": "ba40004c-a6f7-491c-ace4-40ae4a8e9656", "value": "Statement Of Account.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a8ff9ec-7f28-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699552044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699552044, "uuid": "96b428b2-fa53-41b6-8c94-20d6512b3294", "comment": "Malware payload", "value": "017d07cb340592fe4d4fe334c5a39a2b", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699552044, "uuid": "4c3031fa-b75d-4692-8464-67c099ffa019", "comment": "Malware payload", "value": "ddcbd24abbb04861eaabead946bc65862fbbe29b51323e37d57a64aa97d30e13", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699552044, "uuid": "55bb26fe-2c55-45ff-8433-b585fdb54c61", "comment": "Malware payload", "value": "f2ebd9269d9982fb67e1b2786043589f6524b736", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699552044, "uuid": "178c003b-0ce7-4645-994a-95b8addd44e9", "comment": "Malware payload", "value": "f04590604a9be13cd5cbdee420fa07f99540dacd79994ccd4f5b0a13cb4b307146757dfb7790a6b105168e325555e955", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699552044, "uuid": "c5a8cfaf-6eaa-434d-b50f-062c2cb24af2", "value": "T1F623B60BB2F1CE1BF56441759AF7C2D6A636FC289FE08147B26A374E7D351B01A01726", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699552044, "uuid": "3f1f8f9d-773e-445b-80da-20ff4043c6c8", "value": "384:Vo0S1pcx008XGzQ5QWiSAoKXMVkU758/ktYikXXo2LPiFA6AfECJ:VepezQ2MVkq58JiYXtLPsx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699552044, "uuid": "8035cb7a-96d4-4798-995c-f0d65bbb28b5", "value": 47616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699552044, "uuid": "de00a48b-ef00-42cc-89e6-f92305dc9ac7", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699552044, "uuid": "faaa872d-b6a1-4da8-8715-4f146ec76a6e", "value": "\u0421\u0443\u043f\u0440\u043e\u0432\u0456\u0434 \u0432 \u043f\u0440\u043e\u043a\u0443\u0440\u0430\u0442-.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bdad970-7f36-11ee-8907-42010a9c0042", "comment": "Malware payload (MysticStealer)", "timestamp": 1699558113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699558113, "uuid": "2e795105-f66a-41b0-8eeb-df75e6328afb", "comment": "Malware payload (MysticStealer)", "value": "06d0174e25cb60d9ebff2198b2396ab3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699558113, "uuid": "3827259e-3ed9-44b8-959f-4008df872286", "comment": "Malware payload (MysticStealer)", "value": "de14f42fafba4af8154b3482212dfa28d007054275ade3c2dd5617132ce99b49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699558113, "uuid": "053b205a-9bc2-43cb-ada9-6c5a57f477ca", "comment": "Malware payload (MysticStealer)", "value": "d52b422d74742512807a59a4a45ec732c7b0af55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699558113, "uuid": "cc84fd1b-06e9-4d0b-898b-61351969c045", "comment": "Malware payload (MysticStealer)", "value": "a33017be4274be3709e99e73542f4efe2343cce739f91839b726034e603ad9bcf5332b0ec6852800c8d6b4150c98c364", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699558113, "uuid": "b9d19ee1-f43a-462b-bf4e-2e8428b8cd83", "value": "T1A574F112A7E48072E9F517B058FB02830B36FDA19974476B2785AD4E1C73288E97673F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699558113, "uuid": "deebb87d-42be-45b9-a5b9-756fa1205f6b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699558113, "uuid": "37b4f73e-6f04-4e60-9baf-50855625184e", "value": "6144:KYy+bnr+1p0yN90QEH0ST8+kRAUXHx39ONZAQnJv8KW/4CMPo6D2:wMrBy902STxymuQB8PAho22", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699558113, "uuid": "edba17f8-c9e8-4132-a492-f0530930ad74", "value": 338432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699558113, "uuid": "9e5d0b6f-3461-4612-8574-905f322839c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699558113, "uuid": "6ff2f70c-f19b-4d45-9165-8e80ad2e1c20", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1425d49b-7f06-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699537457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699537457, "uuid": "d203cfc3-8001-4ff3-bd28-8e8045330744", "comment": "Malware payload", "value": "291db112190d7fc3ba5b2e88823eaa42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699537457, "uuid": "92634951-719f-4cbc-afcc-b12899d856cb", "comment": "Malware payload", "value": "dfa2209a7ae7dace44c63e8f686a7be87e42cd969344fd0b841d0c58a540f715", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699537457, "uuid": "c953b428-8a41-4a7e-a98b-70f31a9fac6e", "comment": "Malware payload", "value": "07ec2f2724b6069541ccf8561e1cc84e041fe06f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699537457, "uuid": "f36f3074-6bfd-4eb3-a440-ab34f71cd325", "comment": "Malware payload", "value": "ded59f934adae7bc34d5dd9c83019f31d31e71f33b925364a33e079a63566ebe4306ce4976a5d995c66939e24638670d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699537457, "uuid": "b4d5e1b1-ff78-4568-b34b-2394b33661b8", "value": "T1CE6533483A6654D6CC4AFEB21270CBDF5E680025EAD0AEA60413F37D8E365C74FA95F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699537457, "uuid": "b4ab0444-5c1b-433a-a101-4eeda887b05a", "value": "7920018e9f5832a2141792fc00d9dd4e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699537457, "uuid": "b9fe3ce3-9bf6-49b7-bb99-7ef9406857d9", "value": "24576:zVBURZ3QQNT6momhi8ZWZPCxKSsupo33eT6gISoGgUKjMo0/O+WnhXCj8WUt42nO:5Bu3Qo6mphLWZPCS33eQnGhab0/0JWGA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699537457, "uuid": "a1242b45-0409-4b50-9a01-cf25b74d9ce9", "value": 1424896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699537457, "uuid": "f54fdd72-74a1-4e1d-b80b-6a0a1e3111fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699537457, "uuid": "396aa0be-946f-4403-a179-0d06da97a990", "value": "dfa2209a7ae7dace44c63e8f686a7be87e42cd969344fd0b841d0c58a540f715", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5df2209a-7f4e-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1699568505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699568505, "uuid": "d0bc702e-52a3-4646-b9ae-e76e4bb09bd6", "comment": "Malware payload (Mirai)", "value": "4aa7bc993bc4d6ace8e458796b274e02", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699568505, "uuid": "b46d96c6-a8cc-417a-ad45-0db4fc23d6a7", "comment": "Malware payload (Mirai)", "value": "dfd2a63b0d1fd0151d2900d797269f7f6682d9a01e8df874030b42761ae7491c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699568505, "uuid": "6647b436-93c2-4b29-9888-299b0b3c88f7", "comment": "Malware payload (Mirai)", "value": "960ce296cec3db31a73799c46c184e7c9c8f898c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699568505, "uuid": "3becd877-edbd-4979-b1d1-22a9bf52eb3f", "comment": "Malware payload (Mirai)", "value": "efa15abf56f54398302a948199873cb2c026446e930258f2e9889309fb7b4e6e7c870bd5df5cfedf33600f256211fde4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699568505, "uuid": "8b1edda4-aa94-42c0-a27b-e03d2a29bd23", "value": "T156534BC0B643E9F5DE020674306BEF324E77F6F6211AE987E3E49573AC425419603A9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699568505, "uuid": "aef884d9-5e1f-4a2e-9151-ac6fe508b451", "value": "1536:mX23TSwlS4keBfrtOVqlQzYnnmKBPKqSqqtmsbnt05XFEiH:1jSwY4keBfrtOCQsnnFTStBJ0513", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699568505, "uuid": "e464c3d3-6acb-4a2a-a1e8-35ee0e49ab79", "value": 66320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699568505, "uuid": "f0908d42-4b0a-4055-804e-9945472cf338", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699568505, "uuid": "ebf5e028-a8a9-41e3-a5ec-eb79f63757d6", "value": "4aa7bc993bc4d6ace8e458796b274e02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08061bb7-7f46-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699564925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699564925, "uuid": "bbfa5e50-a9dc-4511-9139-e7522214d20d", "comment": "Malware payload", "value": "a16c2a7f230e415e69b75d88efde0016", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699564925, "uuid": "098e58c6-9cc8-4e1a-afeb-5a24846bcdcc", "comment": "Malware payload", "value": "e2d97fcb9e7859905b97e183af4b1fd4908502b682dc7fdcf4f7edc9c6c191b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699564925, "uuid": "96122ba9-e2df-442c-9c99-f270ec509e1b", "comment": "Malware payload", "value": "ebf36703c48ad05ab533655789f9d452ceb58471", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699564925, "uuid": "75ceca2a-3b7d-4d99-9280-bd75841187b7", "comment": "Malware payload", "value": "66c7deec3b6da4db905979359b51e1bb782e711bcfbe86d88a233512e09828c501fea192adf5e86a7575744a5ae897b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699564925, "uuid": "009de1ae-e5dc-4429-9783-2a6c8863d9da", "value": "T17A058D76B5F384E8C30227B018B667755B34A9C10B51CFF3AF24DD2D4936691A83B1BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699564925, "uuid": "c807d2d7-9524-4be4-ad89-e50b82e9d6e9", "value": "12288:+45dZEG2U2zUIz0GzJ4ahTtfviOhJrq9:+yZ/P2zUw0GzJ4ctnnW9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699564925, "uuid": "f13dc103-fcb0-450d-b74c-9f9730c1b8c3", "value": 851968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699564925, "uuid": "a1e4b2c7-a63c-413a-8d41-ec76760c7b32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699564925, "uuid": "7c69f649-fbed-4c2a-b826-a183ac3cda32", "value": "SecuriteInfo.com.Win32.Trojan.PSE.15IBL0F.13614.24163", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3aa44ac8-7f3a-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699559856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699559856, "uuid": "3fa4a799-88c5-4a8d-a304-f8645635c7df", "comment": "Malware payload", "value": "d043a2dad04b5edda2db944f4ce621f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699559856, "uuid": "f72658ae-ca0e-4cde-b86b-58a4ab9f07b4", "comment": "Malware payload", "value": "e3346fe08c979602e5adbc8c80c6b5356ecee04d8331fb626f3f9cf36235ea97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699559856, "uuid": "ff778cd4-4452-4616-977a-e2f8826141b4", "comment": "Malware payload", "value": "2087ac8a835668bbbee974d591dc475e0449603d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699559856, "uuid": "74675c9f-513a-4608-b225-a609eb858474", "comment": "Malware payload", "value": "e788aeb666c0a5fa4b857c4cfa7a08030eb49654c7b38157cd9bceb6ec6605875a576a90ebecbf77a713cfccb4282ef2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699559856, "uuid": "9bdea6a4-3053-48ad-9942-ba39e7673800", "value": "T199B412229BD88073D87A6BB05CF60BD30A3A7CA15934939F37496D4A0DB39D4A43177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699559856, "uuid": "9f8b973c-292e-48fc-b2bd-6f8334afe0d8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699559856, "uuid": "31d721d2-9a75-411b-8956-1a184e81c2c1", "value": "12288:HMrcy90XSe30Rn+o29koY3bicsLg4NkvSLAno/931j:Tyve30QD9koYricsLgekuwo/9R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699559856, "uuid": "597456ed-9019-4708-93c7-05ad02392e3e", "value": 523264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699559856, "uuid": "4872867c-d77e-437c-af07-4dc6fa599389", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699559856, "uuid": "8b946b8f-db88-4da8-b70f-07eb1ed7627f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b99ad26d-7f24-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699550620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699550620, "uuid": "5b6bbeef-c664-4cfe-8807-ba1bca7e09fe", "comment": "Malware payload (AgentTesla)", "value": "ccb662d8983df5c1510748ee910bc020", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699550620, "uuid": "a707da99-e54d-44d3-9ff7-eb76b4c5f6de", "comment": "Malware payload (AgentTesla)", "value": "e386a2839aa002f23e6868d48e2d8590e93ffcaac1ed36152620584209739f1b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699550620, "uuid": "b61a08bd-9f2f-4a11-88a9-6defc8e9766d", "comment": "Malware payload (AgentTesla)", "value": "c93db1be74943fac5b6845eeb03d676b129bc8ea", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699550620, "uuid": "cf351583-e235-4f24-831c-bf190b63e4a8", "comment": "Malware payload (AgentTesla)", "value": "6063b6d30617f2188aa80178ee8523c4358fb1893567ef31eb8cf9fff5efd680c11e8479f72d2560d4ca1b55b625777d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699550620, "uuid": "4e9f6181-00e5-4bfe-8e0f-9d0242c389da", "value": "T151E46A3D59AD163BC1B9DFA58FC5C42BF1D499A73151AD78A8E3036A4342E46F8C023E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699550620, "uuid": "cd1b4c87-93ef-4ef1-855b-90d7604bc66c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699550620, "uuid": "42d964cc-37d5-425d-9733-4ecc9ed7d8d3", "value": "12288:DbCi1VmvNlbel29aaijOJ7PaIUGzjJCGIE22uNoi:DbCi+SjOJuGdCGIELuNR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699550620, "uuid": "85639b89-aa52-40ab-a389-ea47d75e7b62", "value": 705024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699550620, "uuid": "12b382f2-3d94-430d-a9cc-f1070ae1832d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699550620, "uuid": "74dfa05e-83b8-48a3-b7ca-31801f7c77fc", "value": "order pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7708275-7ef0-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699528336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528336, "uuid": "70eb41b6-9917-43c1-8eb7-71f0bf946605", "comment": "Malware payload (AgentTesla)", "value": "f2ead379907f2b7d4c9134c2b96e9a27", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528336, "uuid": "0967722b-5c27-4297-b55b-d82c7179cd7f", "comment": "Malware payload (AgentTesla)", "value": "e4374cbb1c4261f56746246e7fa7ee32d129c1118ce84a728a21160a25998d12", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528336, "uuid": "fc46295d-ea20-4e48-94f5-39f17c8e62c4", "comment": "Malware payload (AgentTesla)", "value": "9ab31bcfcf54b192f8bf55d6b9655a1cafd3ceea", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528336, "uuid": "9f03f023-43d9-4e2b-bd27-2bd291472e8c", "comment": "Malware payload (AgentTesla)", "value": "095fd52a33b0b454e6736bc22fe96faafede2223872225141a16fa161d87de3a41af64910ace5e41327d53c6e2af460c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528336, "uuid": "2bd17053-7c57-4d1d-b0d2-95be8c21bd6f", "value": "T115E47B3C59AC1637C2BADFB58FC58427F1C4E9AB7151AD78A4D703A64302A56F9C023E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528336, "uuid": "a1033135-8707-4220-a6cd-0975f2f76ba3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528336, "uuid": "c6e1112e-a1fa-49bf-9fbe-9e38a4458a2d", "value": "12288:6AOqvg0WuZ44BPQuzjfnIpp1hmCLSiNsI3oQ/++Il6H:LBYHyoun01FLSieoof+Il6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699528336, "uuid": "3103064e-fd4d-47dc-a0af-a009ee82161c", "value": 708096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699528336, "uuid": "662ec92f-7d8a-4d43-af07-fb65154c0b26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528336, "uuid": "62fcdcb4-3a81-43b2-8bb3-23448890fd06", "value": "RFQ-Nam Dinh-Project.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f073441-7f20-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1699548616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699548616, "uuid": "7a474766-5473-4e27-bfd2-90e965923913", "comment": "Malware payload (RemcosRAT)", "value": "5c697eabcdffa1ece5fdd506c3f7c465", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699548616, "uuid": "f81b7835-f085-42ff-b9b6-8f8f87110700", "comment": "Malware payload (RemcosRAT)", "value": "e494067ad724bc7a2460d1458f423960b9b3d70deab022d66a6ee459ed89d84c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699548616, "uuid": "a93ef3de-9712-4ce6-a7ba-d5c080b10b4f", "comment": "Malware payload (RemcosRAT)", "value": "0a831713279469a65a168684ca63ea1229750306", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699548616, "uuid": "36b5d1d7-712c-47b6-a3a2-26635917990a", "comment": "Malware payload (RemcosRAT)", "value": "e134de49d662b72b1a87a127ec5f5946f9cfb00860b9af8bf0199d7b0af8c29e60e833cf13796fe6172c8ee9890e0b7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699548616, "uuid": "8926f13c-c364-4632-a781-24ea7de85ad0", "value": "T12F55234ACD519DDBDCE12EF704205A69CAB35E80DCAC299363613CE0F933681FA8F615", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699548616, "uuid": "3e0cfbda-577d-4068-83a5-d8e7e33dd937", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699548616, "uuid": "326aaa96-1e46-401f-9448-21b97f73e04e", "value": "24576:Wh808nO57xtgqc/4cocCDAZg6ecI/kmy3z1Q9ffy5ocdVkukpc9Bo:u8vcgyPDeg6erMmyAapVucro", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699548616, "uuid": "666d468b-8ca5-4caf-b0a1-4aa86946e46c", "value": 1351440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699548616, "uuid": "2615c788-eff6-4b5c-a9ea-9c8018c8b58c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699548616, "uuid": "9eb55951-6f3c-4933-bac9-8c00b7f71f75", "value": "Updated rooming list.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2704488f-7f28-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699552092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699552092, "uuid": "60c2b2ce-eb70-47ca-9398-148938266bac", "comment": "Malware payload", "value": "0dab98b5611604b6c528c4934a084eb4", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699552092, "uuid": "222d7724-7ba7-45da-876a-40effc5f185c", "comment": "Malware payload", "value": "e62e287fd5172f42a651a685b29228cbb1cff310fafe3ee1ecbe667fbf83f09a", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699552092, "uuid": "d593d495-c20d-4a35-ab11-7676781851d7", "comment": "Malware payload", "value": "af09be55848972664c699ac5babfbf72d11bb5b3", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699552092, "uuid": "da20e4e3-1c46-44d5-b54f-1fd0c50ef4bb", "comment": "Malware payload", "value": "3c0695c20356901d237491e1fbb7c57b1cdd9b13b081ce147cb4de65fe616cd96bab301c5833fc498f140b0b35da07dd", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699552092, "uuid": "d942cac0-9d5c-44d7-98b4-eb580c51a493", "value": "T19B23C50BB2F1CE1BF66441759AF7C2D6A636FC289FE08157B26A374E3D351B01A01726", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699552092, "uuid": "b8f99f9a-09d4-44bf-bfb6-3bf054978c75", "value": "384:kS1p/6g08XGn45QWiSAoKXMVkMQ5mHktYikXXo2LPiFA6AfECJ:kepen42MVkF5mBiYXtLPsx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699552092, "uuid": "77408f08-f5e7-468a-8c48-64ae970d0621", "value": 47616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699552092, "uuid": "9e2eb19f-6574-42a1-91f2-9f7f201e4825", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699552092, "uuid": "ded2b390-25e8-444d-a6fa-51b61529029b", "value": "\u0421\u0443\u043f\u0440\u043e\u0432\u0456\u0434 \u0432 \u043f\u0440\u043e\u043a\u0443\u0440\u0430\u0442.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4b90983-7f40-11ee-8907-42010a9c0042", "comment": "Malware payload (MarsStealer)", "timestamp": 1699562718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699562718, "uuid": "abe11ec6-b55f-433c-ba6b-28090100902a", "comment": "Malware payload (MarsStealer)", "value": "869fe06dbd8a85360d31130bde63f1fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699562718, "uuid": "44490efa-8d7f-4a13-8008-8263ec7bb207", "comment": "Malware payload (MarsStealer)", "value": "e744b79af6c59cc333045532e6ad3fb18105ea1e49f57d61bfdf9ae5b89c802b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699562718, "uuid": "a684c529-d919-498b-aec0-3afb050fb2e5", "comment": "Malware payload (MarsStealer)", "value": "924b059819d40cae0dc685d9565f4d53ba93c2f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699562718, "uuid": "939efd2f-eb6c-4147-bb2b-ab3776cad50e", "comment": "Malware payload (MarsStealer)", "value": "fc072a3d33114bec3df1b59ac6e3d116ee9e42f51b13849b2c23a70ad53b9e722dbcf2ae05a43600056dc66548334c7c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699562718, "uuid": "44f373ef-d84e-43af-95b4-5d93c89e01df", "value": "T1EC444B13A2D07C6AE5234E328E6BC6F86A1EF9618F15379A13F5EA2F05701F1D172706", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699562718, "uuid": "a76052ec-3117-446c-add3-cf254cd9dd47", "value": "cb7a51bdc8561380e94253a2cf0d849e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699562718, "uuid": "98006f7d-9a36-4b51-8c14-297cc9157f42", "value": "3072:tD694QfyWOecor91jGl01vEEBUsNKfJ+28Lb138AF/ny1ddcqS6ngmOyn:TXWOetrfGl0OEBUpfJd81lPSnS6ngr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699562718, "uuid": "a2e3212c-d6e8-4b5c-8145-b7299c47ba2b", "value": 274432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699562718, "uuid": "80a06689-b0d4-4535-93b6-6504f7d87545", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699562718, "uuid": "a3c43187-fb93-4f5c-af7d-1664d103e4f4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f17e8398-7f04-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699536970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699536970, "uuid": "9e4892bb-d77c-4327-933e-37ca13cc0789", "comment": "Malware payload", "value": "8c72f14779cfb9ea502b6185b8b8fbfd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699536970, "uuid": "af21431a-b22a-4179-a5b5-b63c6299628e", "comment": "Malware payload", "value": "e8a860967107ccf1a81cd1a65809fe5462f91d838d25c1b49634f0ebd673d489", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699536970, "uuid": "a474f3f1-6afe-4b76-bb20-754af1b0d917", "comment": "Malware payload", "value": "d2edce58d057b7dfc7a579de67114c50290d4724", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699536970, "uuid": "3d2b734a-ce3b-467a-9ed3-0ade41743d85", "comment": "Malware payload", "value": "5de729298661ffbbf9c4f006c89c152b536c9a324cdb9e3b3b08a42e8c4fd9296837e7138a1c2abf683d3599f3b19657", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699536970, "uuid": "584dde4e-4888-4f80-8468-ae4077bba308", "value": "T14BA48E4AA3A405F9D4B7C138C8978912E671BC5207719BEF63A086761F23BE06F3E751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699536970, "uuid": "3520c94c-cc78-43cd-8a4e-84167345b018", "value": "07891c07bd0c08c5ca5a3b63cc963c49", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699536970, "uuid": "574b04cc-b0d7-48f3-b682-387429c10041", "value": "6144:6qzJDvbkyK5Z8NYFW4FRaA/AAJKQndXs9TB5yohF3Qr7M7eQr1M7rUuQr7M7eQr5:/Zvb65K74aEAQ89Tbyow7G1sUb7G1sU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699536970, "uuid": "c14e556d-e4fd-4c9d-bbd3-e538e358c075", "value": 489472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699536970, "uuid": "dd717a36-a2c7-4482-8ff5-a44633cfe97d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699536970, "uuid": "3131ca5f-16ae-4ed1-a296-5b1f2b714ee3", "value": "e8a860967107ccf1a81cd1a65809fe5462f91d838d25c1b49634f0ebd673d489", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29fc8a96-7ecd-11ee-8907-42010a9c0042", "comment": "Malware payload (PureCrypter)", "timestamp": 1699513013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513013, "uuid": "8b2d5108-45c4-4a9c-b942-e02d5270bca3", "comment": "Malware payload (PureCrypter)", "value": "7e8c7dea1e44777c1c664fdbbd749bd2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513013, "uuid": "268b895c-0f20-403b-ae20-45bfaf1035df", "comment": "Malware payload (PureCrypter)", "value": "e95b4391461c6dd14f204e9c80913682f669428ad20ba51ab5809b55bb26ad67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513013, "uuid": "dddc6f7a-6e1e-43d9-b264-efeab17b1b22", "comment": "Malware payload (PureCrypter)", "value": "f0ce126b95760bb7973d8b54f7276ad03b3a9024", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513013, "uuid": "c1f1bce8-b262-4c1e-a12f-70f40528576d", "comment": "Malware payload (PureCrypter)", "value": "4c4f068d7dee42b7f39a0dceee9faec891c7203c8cc7fa98311065ab29bf7ee5b8593cbf8f32bae45ca5ad23682cbc85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513013, "uuid": "d85e1727-efc2-4b0b-ad39-064c60a842ad", "value": "T16D22E794A76DEAD1D8220ABD5CB75B622A69B527DC599F0F34C9B30F2C036129433F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513013, "uuid": "e8a88098-0e48-4c16-b2bd-f6dd8e653a35", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513013, "uuid": "88e423f7-630d-4a89-bf93-ba385c407703", "value": "192:IEuwBkA4tMwSZfiiLX2HS9yxSyrsRt8G3mSF6zEdst:cwB+tMviiay9ycyrsR2vZAds", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699513013, "uuid": "ff9bf8eb-5538-461c-b083-469598603bab", "value": 10240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699513013, "uuid": "387c2df7-4737-45ae-b86f-49f888a84701", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513013, "uuid": "34b66d40-fba4-4ece-8ea7-37527adaec85", "value": "Product Design 1.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cb96ecd-7f47-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699565604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699565604, "uuid": "f14da554-a81a-407d-8471-64f730ba03cc", "comment": "Malware payload (RedLineStealer)", "value": "f2057621dafe3cf02981cb350fb8ad4d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699565604, "uuid": "2bc6ecac-2c83-486d-9b86-b0b65a609890", "comment": "Malware payload (RedLineStealer)", "value": "ea8ecda6aaf0a6560b614a46a33112caf8ab6404be64ced23fa202737ddbacbf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699565604, "uuid": "5741698f-eca5-4652-9200-f5ec6570c193", "comment": "Malware payload (RedLineStealer)", "value": "bf6ab848e5d91a425f04bbabb82575e9574dfcfb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699565604, "uuid": "bd581fc6-deb1-47ae-9a1a-79f7e506e06a", "comment": "Malware payload (RedLineStealer)", "value": "4824199e49f23c2806aedc147ce75784d05614f9697f2b5b44d9c32c99da50a06c17c1889fea07abb75d7b66a81f398e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699565604, "uuid": "bf7de662-4e24-4438-91f7-6b9333655835", "value": "T1DCE41213BBE88077E9715B7024FA13D30B357CA25579427B2355AC5A09F3DA0A832B7E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699565604, "uuid": "a7333105-be30-4c32-b9b8-58b60935befa", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699565604, "uuid": "54cf088a-9a3b-454f-8ed3-575573905209", "value": "12288:nMrvy90qCuyf+7apRUEglUwkYwLVeRk6EmYmY8BUs2Rww8lOXT+w3ZRbpPlZKfch:QyYRQEgnkYwUUmYmYY92RwDlOXaWTFXD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699565604, "uuid": "69ad894e-9773-4ae2-8151-e68cb4a2d4ad", "value": 708608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699565604, "uuid": "8e3c8e2e-f1b1-4bbd-859a-b8deb51d5d39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699565604, "uuid": "77a95cbe-2e88-4327-9c39-99467126a9f6", "value": "f2057621dafe3cf02981cb350fb8ad4d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebb4c35d-7f3f-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699562300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699562300, "uuid": "63a9c228-5e7d-40d2-b27a-e8f56a8adb67", "comment": "Malware payload (RedLineStealer)", "value": "cacd315838b8fc3927e26523640b7b97", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699562300, "uuid": "d37d7323-1944-4aae-8c06-9ea310c51084", "comment": "Malware payload (RedLineStealer)", "value": "eb556e24e841ba2f8498189a37e9529fc8e0951fb48078ff5a3d2aa47cf9a852", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699562300, "uuid": "35e99bbe-93ee-4e94-83cc-45413c5bff03", "comment": "Malware payload (RedLineStealer)", "value": "01ad0e9e03b2ded6712e12b4ef096a63a6b3164c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699562300, "uuid": "dc36f023-0bcb-4dae-bdee-927fe66df794", "comment": "Malware payload (RedLineStealer)", "value": "a5d0ccf11e68893ede58134eea9ad2400dfcac12d703d3a93bb331c8c9a16a0885004e068ee8f1a882622aa7a15d0abc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699562300, "uuid": "b66fc67d-5d6f-44ef-830d-57f1415574c4", "value": "T1C9B41212ABD8D432DCB51FB058FB12830B36BDA16DB483AB3742994F1C72694A53177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699562300, "uuid": "1785b721-7299-4b23-8d95-1947070bdf6c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699562300, "uuid": "22c0d337-5ab3-4810-b063-c4285b7b657e", "value": "12288:1Mrny90IWrL4ybciKsyFgMJZeKBmjpRGjjGaUaRN:6yP7ybKdZBBwAjjbUaRN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699562300, "uuid": "56fccfaf-ed10-43ac-a89a-9a9b37626288", "value": 523264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699562300, "uuid": "ce4dc7a4-d708-4ac2-b8db-3971be7cb561", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699562300, "uuid": "ecb83695-bf98-4a3b-8d08-a9e5d5b89497", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d95db7a3-7ef0-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1699528339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528339, "uuid": "abfc3645-8e5b-4729-b254-a416338d4e99", "comment": "Malware payload (Formbook)", "value": "5ac779a6250c6ec0ff710bd634b37b51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528339, "uuid": "7b7e6e10-7747-4ac7-a832-fe9ac63afc2a", "comment": "Malware payload (Formbook)", "value": "eb579b2da7f6601c803c0231f0528e99c38ccfe3d84349717f744684c125967b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528339, "uuid": "4c0d959e-facf-4bca-833f-462bd24a1270", "comment": "Malware payload (Formbook)", "value": "d7c399d11c413b78e023666538299d870260722e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528339, "uuid": "dfb993dd-7f40-4a44-8c83-e5551d390d9a", "comment": "Malware payload (Formbook)", "value": "82d62e15ead23ab4dd15ab1872b36675df5da2a8d20074dadea445da82b29005f9b8b46bcabea4f80dbbc8abe1a0ad00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528339, "uuid": "2dc7a350-69ab-43f1-a8e3-ad4756c3ab8b", "value": "T1ECA4D0DDE74298E5EC2652B1287EDD77672B9C2E2C58188919C77E373C71193303A88B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528339, "uuid": "a7e58039-d6a8-4e13-8045-3fc2ffef9fa0", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528339, "uuid": "91dc733b-bedd-4a21-8a8f-a11dad97409a", "value": "12288:PrcoM9ga8htyeFlE07xntEHf0EjWLdMoph0Vox:a9g6US+xtEHf0hZMQCox", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699528339, "uuid": "ced00cd7-9237-4e67-8db2-16d1658ef944", "value": 484943, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699528339, "uuid": "08ce9780-a309-487f-ab6a-c15c5b908618", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528339, "uuid": "644e9a62-3814-4709-9373-d6968fc7efd1", "value": "SwiftMT103_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dc9abad-7efb-11ee-8907-42010a9c0042", "comment": "Malware payload (MysticStealer)", "timestamp": 1699532910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699532910, "uuid": "7b417d0e-254a-41bb-8ab2-330695bfd5d9", "comment": "Malware payload (MysticStealer)", "value": "f2748aa4fa7eb185340b38dc07d2e5bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699532910, "uuid": "7bab9aa4-2dc9-4a53-ac37-9662ebf13897", "comment": "Malware payload (MysticStealer)", "value": "ebbab78a2de13cc6c93b80b8823c47edede9965ac270177259b72e33f50fe4c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699532910, "uuid": "557248c0-fe71-44b6-8598-d148fa240ec0", "comment": "Malware payload (MysticStealer)", "value": "db36c9fa148f4a43b56ed9061b512386a5fa552f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699532910, "uuid": "e569af98-9f31-4fe2-a868-5a68bc48e6e4", "comment": "Malware payload (MysticStealer)", "value": "f7d24217d011a4763994f653a583232eea7ab3b05187cfa28d0f5349d0e69e82f69ee8e54fc4695d78d64a62c80d80b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699532910, "uuid": "522bdba5-b60b-4b67-8a1f-ee8991ae4831", "value": "T1D974F156E7E95073D9B1277018FA02D30F36BCA1A9B8976E2341689E0CB36D4E871737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699532910, "uuid": "ac56f6fc-3465-4cd8-b3e0-fb823c2e4b0c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699532910, "uuid": "7fc274db-c3cd-4ca9-bff1-f9b5d8aae342", "value": "6144:Kcy+bnr+up0yN90QEw5MJkCRvH+Krd+GnsmgvMifIivCoLx4z8/nny:QMrmy90VkCR/+Krd29Ii9d/y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699532910, "uuid": "adf76064-14e1-4459-8511-3501597ece51", "value": 338432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699532910, "uuid": "b2390657-eb09-4236-9825-836dab6a6618", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699532910, "uuid": "e56cb28b-a7dd-45bf-931a-aab845280008", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff39eac0-7f0c-11ee-8907-42010a9c0042", "comment": "Malware payload (Pikabot)", "timestamp": 1699540429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699540429, "uuid": "e7414f5d-6928-4149-97a0-14d2c1e787c9", "comment": "Malware payload (Pikabot)", "value": "4f1788153561879695459958ec8dd6d6", "object_relation": "md5", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "pw-H17", "colour": "#5A0D28", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699540429, "uuid": "10ac0c45-a35c-4b74-9fa7-ef1a5e22b18a", "comment": "Malware payload (Pikabot)", "value": "ec43dc591301ff2396c6bbb05e0c0f3c67428d892b186c43751ededea4df222d", "object_relation": "sha256", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "pw-H17", "colour": "#5A0D28", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699540429, "uuid": "90a2aed8-0e4f-4477-9689-8a55d16be7a2", "comment": "Malware payload (Pikabot)", "value": "0bf3d9ee49972839fa9cd88cb8e43d307789c8eb", "object_relation": "sha1", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "pw-H17", "colour": "#5A0D28", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699540429, "uuid": "8097c281-75dc-4895-9073-593bf05b3bce", "comment": "Malware payload (Pikabot)", "value": "d64872b32cc3990263f3d5e46b07e4589122d8d5f0da8d02301608d773962fa4dd1788fb5d5b1805f05a05cf59e2839b", "object_relation": "sha3-384", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "pw-H17", "colour": "#5A0D28", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699540429, "uuid": "f2d0fc13-b636-464b-aba8-ec6f70006ab9", "value": "T1C80412F8EFA135309B472C1F9423E0C9A544EC88A69D69D0CF4D29EC9654F3E8776AC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699540429, "uuid": "6ddfe7e0-00b2-493c-b855-87f92a28f308", "value": "3072:CGN4snjqv3nnYpazpFuS/dLqBfBceQV0pTBKv0FrnOCSkILFNikdc9K76yJ/8IRv:N4sn+vIupFuIdqCfCE0FrnHSnJpGK7jt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699540429, "uuid": "e9ccda61-b48d-4869-aef9-1e78d4653ec1", "value": 173468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699540429, "uuid": "8ad585fc-e6dc-4c9e-b980-687ac4caa140", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699540429, "uuid": "92e4f933-4eca-4a39-8168-79544e3f9bb8", "value": "NRQZO.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04bc4e2e-7f08-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1699538291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699538291, "uuid": "d49cd472-8c6a-4049-b079-b64a3ec07eec", "comment": "Malware payload (Formbook)", "value": "35243bfed15d5a0eb988ba62b3f41ae5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699538291, "uuid": "0bd464ba-0b00-43d1-a508-d40cd900854a", "comment": "Malware payload (Formbook)", "value": "ee87f646871da3ccd9efda67ac9d782701d42ad639db7f94ef70ff1ae958baf8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699538291, "uuid": "4f8c4a13-5369-4447-a888-51387c5457fe", "comment": "Malware payload (Formbook)", "value": "5929f761b423c2751133d93c0069d2846d214fd5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699538291, "uuid": "5c7f04a2-d334-4804-9973-99b46366fc5e", "comment": "Malware payload (Formbook)", "value": "f0c7d1ab8ea8f7497be4270d2c6a677b798feb996ad6aee9150f23ed91b918a4cc30b2ca5d8822937f021d2c3f834809", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699538291, "uuid": "b573f847-e422-46eb-8ed8-4420e29e2897", "value": "T1B7841242B2D244DBEE3B1DB2541FCD3164A20E6CD5A9920FE3C97B3F829174105AF7A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699538291, "uuid": "7af56e67-2de4-4985-b1d5-3ceea12433cf", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699538291, "uuid": "58e689fd-efd3-494e-a558-7108a30274c5", "value": "6144:58LxBX6kkMNZoJG90tt9yVBaZp0oufjak7kzBzG+DI4vhGSZbo/d9mXIS43BXCP+:vMzT3VI5TjlzrcYhGSpoViIb3ByPStgo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699538291, "uuid": "1d81cbc4-96d5-4c15-85df-805b279ee890", "value": 379613, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699538291, "uuid": "55d67491-8df9-42ce-869d-4297b238448f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699538291, "uuid": "f111ba94-5144-4efe-8755-b0849342e511", "value": "RFQ No. 64002292TMS.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c281eba5-7f41-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699563090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699563090, "uuid": "380cebdd-6bef-4a69-bc98-dc6e0d84abc7", "comment": "Malware payload (RedLineStealer)", "value": "2cc708f3d55601725c84f96a09757160", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699563090, "uuid": "162157db-7977-4949-a5c2-19d30cca3ab2", "comment": "Malware payload (RedLineStealer)", "value": "ef19502103975d722d4e7e31efa10e138b033507c9b3ffa65a60566220314f72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699563090, "uuid": "10f4b607-fb4e-4143-9dd5-40ff5d88dd34", "comment": "Malware payload (RedLineStealer)", "value": "7be5de8be61fcea3af1a75bcec06c6a4d40049c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699563090, "uuid": "18e2180b-a709-4e7c-98fa-252464649851", "comment": "Malware payload (RedLineStealer)", "value": "90e5cb0d0be69c47ac91d9c8d4919697893cd5d8c1b949d536f5b11a4e7c9bba38b512e2b6ad5d8efc64c5ee95188a3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699563090, "uuid": "aa28d24e-4986-4c46-8fb3-ee58d5cee442", "value": "T1BFB40253A3D88973D9F96BB008F706D30E3ABCB14934936B2B462C1A4D73AD0A571767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699563090, "uuid": "9b982b12-24e9-4fdd-a885-7d9719633c5c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699563090, "uuid": "a3804e65-8abe-4de8-aadc-b1a0e981646a", "value": "12288:rMrJy90O2JydXHUDXcOCmymAR9xRcqZgZCmgDBSFeZJ:CyV0cOhymAR9zR0uDcFeZJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699563090, "uuid": "a96ff1f9-db92-4201-a70b-6f53dd5578cf", "value": 526336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699563090, "uuid": "ad0918a1-6205-40cb-8b33-5339c54be4d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699563090, "uuid": "44a03d1f-488e-4899-abcb-20997038c3a6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "753aa840-7ef8-11ee-8907-42010a9c0042", "comment": "Malware payload (Mimikatz)", "timestamp": 1699531607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699531607, "uuid": "c604460c-59b3-4533-ae45-2d3564848b53", "comment": "Malware payload (Mimikatz)", "value": "3c4e61f097bc2ff5efa6f56f07560abc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699531607, "uuid": "53d34f77-6abd-4d2a-be99-40c451010911", "comment": "Malware payload (Mimikatz)", "value": "ef23f59e2d240e13e9e8d711a13b75e8941cbe412b88220e962ab313716af96d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699531607, "uuid": "cc741281-2713-4d43-9226-29169b3e07e4", "comment": "Malware payload (Mimikatz)", "value": "4d32b5ca5daaa79db724d1b7c7abd53165f8c675", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699531607, "uuid": "b9cf35e3-83e6-40e8-95e1-9c03a64e7761", "comment": "Malware payload (Mimikatz)", "value": "b05e29e9552405de1406e1752b2c6a541d13450c7c2b7c1729bf4a85ccb4585ad9bdc6761d0bdeef357d28ab2c4d0a4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699531607, "uuid": "f389a578-0e5e-43ec-850a-dabef847e5d8", "value": "T1FB663381F0928CBAE8F611371AB6D1353E7AF5230B0585AF639C5A9779303D1A77C61C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699531607, "uuid": "f2c8b559-0653-4a53-a163-2995c9864ed9", "value": "4df47bd79d7fe79953651a03293f0e8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699531607, "uuid": "f6835308-b02d-41cc-a38e-642d7c706341", "value": "196608:eAqjTpnhXlmyWCZNulPKQ8hY/Bkr/fOIT/+VdlBFKazf:kfauN/HYOSIT/EVF9j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699531607, "uuid": "69682b42-0f2b-4736-9e2d-3ca2b0db00ef", "value": 6967159, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699531607, "uuid": "d9a51fe4-6601-455e-a08c-8e4c7b2b3128", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699531607, "uuid": "0e10ddee-f037-4d1a-888b-ca012c4d7458", "value": "ef23f59e2d240e13e9e8d711a13b75e8941cbe412b88220e962ab313716af96d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22236b83-7ecd-11ee-8907-42010a9c0042", "comment": "Malware payload (PureCrypter)", "timestamp": 1699513000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513000, "uuid": "f61b47fa-677c-41eb-b3fa-80b586d5d575", "comment": "Malware payload (PureCrypter)", "value": "af751f57de852c7eecb944a790c7b00a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513000, "uuid": "94e4d44d-55ac-48da-9f3e-3a8fb9f2332b", "comment": "Malware payload (PureCrypter)", "value": "ef6b1498f2313a0f7d997912e86b95e642309f70f0fbf026f8ba14974b289afb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513000, "uuid": "e09d5a7c-59bb-42fd-87d9-58a6218545ea", "comment": "Malware payload (PureCrypter)", "value": "58ace1a0fce0c21cdf1484d452fdac9304f09595", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513000, "uuid": "af74b65e-90dd-44ed-98b0-c2af0f053f0c", "comment": "Malware payload (PureCrypter)", "value": "933d9a23a6c85a3e0a4d93092a05c34fc8652692b87f954f777c9e77e177b2ae3536c3681e7ef68439040286f7de9759", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513000, "uuid": "9a4ca084-8b83-4c8f-8768-fb3ff44e8423", "value": "T12822E694A769D6D1C8221BB96CF75B632A5AB617D8499F0F31CAB30F2C036129433F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513000, "uuid": "263212d0-3b31-45a2-bbbd-9af181f48828", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513000, "uuid": "b4c677ab-d83e-4185-9aec-5e86b3f13887", "value": "192:7wBJ4tJTmZfiiLX2HS9yxSyrsRt8G3mSF6zEdst:7wBytJMiiay9ycyrsR2vZAds", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699513000, "uuid": "a1a1958c-b796-45b2-b67f-853e77b0827d", "value": 10240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699513000, "uuid": "0f7bbed3-add4-4854-8177-da04eb7da7ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513000, "uuid": "750f8129-4f8c-4f9c-a071-2550518cccdb", "value": "Product Design 4.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "847750d9-7f00-11ee-8907-42010a9c0042", "comment": "Malware payload (DBatLoader)", "timestamp": 1699535069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699535069, "uuid": "a2625701-b7c4-40e3-a51f-95d6a614c820", "comment": "Malware payload (DBatLoader)", "value": "0c8995a5f643911ba5b7c1f375ff35df", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699535069, "uuid": "331eba39-1736-43da-a909-c258eeddb6f6", "comment": "Malware payload (DBatLoader)", "value": "f0c9f4407a4dbaacf4b274213cf91b1804d8d612b8a27ec74cd8447b032b4fa9", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699535069, "uuid": "fe31639c-217a-4cad-94ee-f7e497f78b58", "comment": "Malware payload (DBatLoader)", "value": "e26906d6bc01b45242218f9fbb44d81b3d9cd80b", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699535069, "uuid": "f716f0c7-90ae-4b09-b87d-804f0d588a6b", "comment": "Malware payload (DBatLoader)", "value": "1b5c1b62d1d845d9409c11958e3961875fcbf4b7760a75064b29b64b045d3a9145863e4b905bbeb4d2d251ba45e9c016", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699535069, "uuid": "55a36458-8ad0-4b72-bc8f-9d2645196232", "value": "T140A53326F2B06A3F3576E1365758C7176524EB95DA2A22CB453C6F07BFF2E44AE02108", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699535069, "uuid": "54b9b9a4-de65-46c6-8cdb-8fd948841ca1", "value": "49152:nWnnuBHXor1Wffk4hk5vvIHTOBrnd++A2vmJr2eIJH9upUQSV:nWnp6M4WvwzOldLcJr2eIJ0p7SV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699535069, "uuid": "b4d37717-c090-4122-89dc-7c3ea51116d4", "value": 2152684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699535069, "uuid": "e1bb58e6-e8a9-4c7f-8284-0fe94c8ca659", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699535069, "uuid": "e8ba6e4b-68fa-4aa2-bd53-6421a05718e1", "value": "Wcqjalsaneurrm.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45b5bbff-7ed0-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1699514348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699514348, "uuid": "8d17b221-0e51-433f-9026-2aaf5f4a4bde", "comment": "Malware payload (Formbook)", "value": "1f061e24e82b471e201b57b67f446b7b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699514348, "uuid": "f35f386e-721c-4daf-bf12-c852dfeddc32", "comment": "Malware payload (Formbook)", "value": "f26ef2dc3870b6ee2f05973fcd97b1e55f817524eac8bdbe6863e584c6cf2821", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699514348, "uuid": "0c7878bb-261c-47d4-bd5c-c03926e3789b", "comment": "Malware payload (Formbook)", "value": "38eb108a25c85f8dfa59ad7d4d09945f9e26094b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699514348, "uuid": "f0ad180a-3406-4621-8396-a79f17eb1ede", "comment": "Malware payload (Formbook)", "value": "95468da6b122ba10d4b7095a560ed8c85a9c9ef15bd0a2d14290854e7ebb86c26a5ee9916278490c2a6f1b7f5db24f86", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699514348, "uuid": "cf5a5589-a276-4d83-8c5e-012661c23ea7", "value": "T1D9D46A3D1EAD123BC1B9DFA58FC1D42BF1D4A9A73151AD78A4D703A64302A56F9C023E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699514348, "uuid": "c4dbada1-37ba-41a9-ba9b-35d4d11951b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699514348, "uuid": "a59e1c94-48a6-47b8-80f6-d089587dbc38", "value": "12288:oazTHA60Bj9e2hcdm1E+vme/TbyXKmusfchlX+GdTpq6/C+7:oafHyBjA2hE+Oev/m1fcTuGppJ6+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699514348, "uuid": "5ccc8cb6-2bef-4a78-ab8d-c1706910e203", "value": 646656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699514348, "uuid": "de02207d-c671-4840-b5aa-aa6af28bd05a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699514348, "uuid": "20ebf7c6-4093-4bf0-a664-dd2ee48d9833", "value": "1f061e24e82b471e201b57b67f446b7b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71fc5cb4-7f00-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699535038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699535038, "uuid": "ab41de11-4b47-4b49-8874-932ca1c2413c", "comment": "Malware payload (AgentTesla)", "value": "7e43a25d86f2601ae3bec7ef06df017b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699535038, "uuid": "f4167fb4-80e6-4135-8af5-67f92233a458", "comment": "Malware payload (AgentTesla)", "value": "f281d0cd25d9dc8b85212323cb16829069afc3978f6f89b3b10d228da0da5d35", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699535038, "uuid": "55546bfe-d541-4d15-836b-027b6dc3c239", "comment": "Malware payload (AgentTesla)", "value": "5b8d4a4ec4422a3c0aa21ff629985806dbf0043a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699535038, "uuid": "7ac809d1-90ea-4ae7-ac1f-6d85feffca4e", "comment": "Malware payload (AgentTesla)", "value": "a35d68099c584472ae56513f1c3d6f75f7392f09e4ad7704454153ec7aec7e4b305d88553dac714ae7747916953ea6f2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699535038, "uuid": "ba5095b3-ee12-4404-bc6d-d40da46d59fb", "value": "T1EDF47C3D69AD123BC1B9DFB58FC5D027F0D0A9AB7151AD78A4D703A64342A56F8C023E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699535038, "uuid": "c8275ba3-4f27-4330-9b09-678e5093ffe5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699535038, "uuid": "bc1a194d-f6ff-4103-a850-c7cb845910f1", "value": "12288:A8Yg+bXuNg3Shc7XQFXEnFQTvM9bMskyJ6LBLlCJ/:DYRDuNZUQFXE2T6OyO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699535038, "uuid": "20d7d889-8c39-46f2-95c3-114ea04bca00", "value": 730624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699535038, "uuid": "62cab9e4-9c6b-435d-b9a4-0f7b304f8a03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699535038, "uuid": "d382e5e0-3c25-4656-bba1-4901845806ee", "value": "2023-11 CV Forner Eugenia.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc80fa0f-7f11-11ee-8907-42010a9c0042", "comment": "Malware payload (Pikabot)", "timestamp": 1699542572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699542572, "uuid": "44a2fd80-8cd4-4c59-8827-e73e679d4510", "comment": "Malware payload (Pikabot)", "value": "e681c181591fcc77214fdf852658a645", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699542572, "uuid": "11709531-47a3-4de4-a0e2-76858f5a4f39", "comment": "Malware payload (Pikabot)", "value": "f29d1f2014389935942b010a706476e4aba76afcdc3339b3a853d12592074d1b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699542572, "uuid": "79bc6285-adc6-485d-bce6-4bba5d2e04d1", "comment": "Malware payload (Pikabot)", "value": "94c5840a7e09bf9cdb0226aa16a7fa818323181c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699542572, "uuid": "bd626fc6-3e03-42d2-96e1-5d9ded4c9e33", "comment": "Malware payload (Pikabot)", "value": "f25d3fe94d2114d410a35a31ed5887661240bba37ecbb984d4d452e94c095e4c0ce6afc0a9d86844e0256dbc4c57a2d8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699542572, "uuid": "d882ea71-1088-4005-8311-5f2599ecf5a6", "value": "T17F55F191D5405035ECDBD274604D31B626AEDF7323A1B2C71B1C5AEAAE38BD02A743DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699542572, "uuid": "79a8e0f4-dad8-47ef-a3eb-ef092937ae5e", "value": "fa0e64147431993f5a3e8765dd918c86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699542572, "uuid": "ddfcb97a-8df6-4662-b6d7-c92a3ec785e9", "value": "24576:XDOgwgfYbK9s3kW3CG3vQ3snpR7loatbEUZqHwhv642THJ1r63LSw7b8VzkPPjwb:XDOyfYbK9sZvw8V/qQeHf6JUawknji", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699542572, "uuid": "1e51ccbb-92fc-420a-8c7e-c8ab132e8762", "value": 1296182, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699542572, "uuid": "e2736298-e7eb-408f-a3f1-f1294c0989de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699542572, "uuid": "ab9e8836-202d-456c-aea0-1cfc597d435e", "value": "c2.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9519e723-7ed4-11ee-8907-42010a9c0042", "comment": "Malware payload (zgRAT)", "timestamp": 1699516199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699516199, "uuid": "11e14326-3ced-4b4f-ab31-31b9ddf80285", "comment": "Malware payload (zgRAT)", "value": "c8ee2d2bcc1bec9eedd414f3629c56ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699516199, "uuid": "0773b908-0cb4-41a3-8d3a-26131a5edb89", "comment": "Malware payload (zgRAT)", "value": "f36032942ac79b53ff9c06ff9bfae8e22dea553c116c53b70cc9d07dc312c463", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699516199, "uuid": "2fd74b49-a31e-4a7f-8cfe-255f8ed55f51", "comment": "Malware payload (zgRAT)", "value": "af33074b05e71986ae32a7973f9de8b1866ea364", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699516199, "uuid": "4eef9117-f412-422a-b0a4-44f14851eba9", "comment": "Malware payload (zgRAT)", "value": "ad2c68a137ddba7562c49023332441e36881c04bf4044e65405853259aff5769ee5248222c0098be876add2ec23f8959", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699516199, "uuid": "66314c40-e062-4bed-9a46-c78358e6fdd2", "value": "T1FD83392A07C8CC77C3DD19FC9462629A8BB5C7296483FB87398C79F4650378D6909BE1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699516199, "uuid": "861b3894-e234-44ad-8672-37020618ab55", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699516199, "uuid": "a2a9d212-a216-469c-9f44-ba0d150c73c5", "value": "1536:yPvesM5U1c84V7Yjj9AycIt3cv8mSmNM3/W93O9oUaao1gNv6J:yPvesW2c/VUjj9AyH3487B3e9e9taa8f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699516199, "uuid": "0ac548cd-51b6-4084-bb97-4154185fd562", "value": 83968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699516199, "uuid": "0125ef7e-9cae-4c38-a4c5-1f51b2bcbd0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699516199, "uuid": "f7b3caf9-a6bd-4dd6-a597-8cb4827b43cd", "value": "PurchaseOrder 60104909-1123.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73c0b2a5-7ef9-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699532034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699532034, "uuid": "f5e1fa74-e9cd-4f33-9318-605c45addbbf", "comment": "Malware payload (RedLineStealer)", "value": "432abaa2cc7e764710d3c2166bc6c9b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699532034, "uuid": "a15536ac-e2ed-45c7-8c8b-1e390486b664", "comment": "Malware payload (RedLineStealer)", "value": "f41c4868970ee1f3f156330275c6722d621fc17b42b78b583ca0988f2aeaa3cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699532034, "uuid": "c8bc9266-d4ee-4220-827c-cba4ed95c0d2", "comment": "Malware payload (RedLineStealer)", "value": "9c03ad29ccd1e1fa4c139174c1f708e652b38239", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699532034, "uuid": "bb2fd78f-4b00-442b-bcbf-7178e157d07a", "comment": "Malware payload (RedLineStealer)", "value": "e2c02bdfb3b99fe196f7cfefb851ab91820c9d7e0595c3f54b6795ffdd8ac6dc74bb0da4c1ae3ee34d3453f5c8e90267", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699532034, "uuid": "5360b8fa-0e81-41a4-b140-5c82cc473de9", "value": "T13E356C103EC5E468EED210B1069CFA6747ADD5EC0B6446CF069846EFD7D7AC1AE32E81", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699532034, "uuid": "5c27c504-15d4-4af2-853f-e9c5fe7d1904", "value": "b11c9cd467b185b2c3a0a894930ee4ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699532034, "uuid": "598a6f80-4bad-464b-a206-14f0ceecce83", "value": "12288:UC9oUg5ZMa29AS087kHCqZfjIR+LbUjZAkEuWSeYnJr5NK6E4Ed0lKK:Ul15l29AX87kHCs8R+vulK6neu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699532034, "uuid": "83e6a176-1126-4d31-8159-48540278ca7c", "value": 1157632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699532034, "uuid": "31d65755-96f1-464e-915b-cabc8a42a14c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699532034, "uuid": "1a02e11e-cf46-4853-a436-224c046d353e", "value": "f41c4868970ee1f3f156330275c6722d621fc17b42b78b583ca0988f2aeaa3cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59b4a34f-7ed0-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699514381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699514381, "uuid": "23f8199f-8d9c-4b45-91c3-f9d6d857e0cb", "comment": "Malware payload (AgentTesla)", "value": "026598ac515930a21d18905f56f2b742", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699514381, "uuid": "9b96daaa-189b-49df-8efb-7399e33b18b8", "comment": "Malware payload (AgentTesla)", "value": "f43730bab7ee94409207bd26d811c1afb9c67a25171046ab0ae800e6cc35a5ba", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699514381, "uuid": "aea9d3ef-4bd9-4b48-837b-9684b0202b97", "comment": "Malware payload (AgentTesla)", "value": "032f3f03199e0ffb61d10386a5d729fb4d437158", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699514381, "uuid": "5bde5d4a-b508-47d0-bf49-d12efa4213c9", "comment": "Malware payload (AgentTesla)", "value": "d29f60a57b8ef1fa30f5481a034ec321ffb963987a3d377c9820fbe110642293b61de8bce9cc8d0ce2e7832b7945858d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699514381, "uuid": "20f246cd-4f00-434a-9ba8-9bf94a363284", "value": "T19D74F1767FAA61F2DB839533E614EBD74B6094F22A723B9B3504234608DAE11DCC072D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699514381, "uuid": "a7450433-fd2f-4ece-abef-27a00af6ce39", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699514381, "uuid": "887aa152-6c15-4844-adb5-33669a92f4e8", "value": "6144:cHBksdgfxE6RUhru1sPyPw1PpUyL7NYpwsWsA9zR1nDbtTLLyCn4ulhBKdx4F:cKr0yPyP2ySpwx99zjDbtTf7nrlhBK3+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699514381, "uuid": "6c60e8b3-13a6-4dab-be66-ff9bdd6456ff", "value": 361984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699514381, "uuid": "85bf333b-d3cc-4db5-a63e-ff18f80878d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699514381, "uuid": "e089e115-a6ee-4ae3-b63f-ced12d5b372b", "value": "ODEME 1108.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "287abe97-7f45-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699564550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699564550, "uuid": "c99e89a4-2734-43d1-836e-642fe0a2bc3a", "comment": "Malware payload", "value": "044741b1e7376ba4293de08c219c8d4d", "object_relation": "md5", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699564550, "uuid": "bd531453-e062-4db4-a0c1-b579f61799bb", "comment": "Malware payload", "value": "f4d0995a2fe461ce29b3fb7b4a8479b92a47396d245fe627ba56881877dcbe25", "object_relation": "sha256", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699564550, "uuid": "803cb7ba-81cc-46a7-bdef-2037ddc68082", "comment": "Malware payload", "value": "930d91f69499a6d2abc057716cc0d152a4828840", "object_relation": "sha1", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699564550, "uuid": "f534cc21-4f4d-4358-a826-095c1afb5cb3", "comment": "Malware payload", "value": "e1888772f8a33f876788c311b77f7f62705e7b2e49cf1379f0fb0c9db7e62f84f34f07957a2eac69e143f568678e87bf", "object_relation": "sha3-384", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699564550, "uuid": "9ea6cb0a-0926-4450-ad0f-1120cb2a9f56", "value": "T1ABF7332D1A428BDFD791D6FEE36D7306F0AC0A601DD438997A0C755D09C88A60FBB35A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699564550, "uuid": "616bee63-4635-4481-9c49-d043bf20978d", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699564550, "uuid": "4936b034-4dcb-4bd1-9fad-77127741381e", "value": "1572864:14/4rzOchPTEXJ8uWBIgYA+FldhnMwZhZeSVygoOFKIms4lRZU7cZ+H7:CkqcdTEXJFoN3qXhJ7cSYNtIERo3H7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699564550, "uuid": "ac335496-28a7-4ed2-a309-c61afbf8bf52", "value": 74215459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699564550, "uuid": "4b32bc3f-cbb5-424e-b803-fd3490a6ffbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699564550, "uuid": "7ef537cb-4a9e-4fdb-8cd5-8cb51b6c1c0e", "value": "Counter Strike2 CHEAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fee3f300-7ee3-11ee-8907-42010a9c0042", "comment": "Malware payload (njrat)", "timestamp": 1699522819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699522819, "uuid": "d44033a5-0204-408e-843a-87ba29189335", "comment": "Malware payload (njrat)", "value": "a307642ad8c9ed628244ee2831e141a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699522819, "uuid": "5276337d-11fe-45c6-a46f-e347e1cf3e29", "comment": "Malware payload (njrat)", "value": "f5753942a3fa5694830e189a2b35fa9f43f6311f21b7106991ca3f8e789c7088", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699522819, "uuid": "d6851037-7612-43de-8674-f04e09ec3381", "comment": "Malware payload (njrat)", "value": "23aa69e79a77afa2b27f52335b56383954a48300", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699522819, "uuid": "e4165143-142f-4d54-b995-2afe42408ba1", "comment": "Malware payload (njrat)", "value": "7f25c6f222074f197fbb516ada19699eaf49068b7ff5c001f6d21bda439ebd5cbdccbb4c17066dbc2b276e1e3472c6ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699522819, "uuid": "1bc9f520-6cf9-4016-8f56-23cad55441ce", "value": "T153032B4D7FE18168D5FD057B05B2D412077AE04B6E23D90E8EF564AA37636C18B50EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699522819, "uuid": "5bfd90ff-d9ef-4d8c-aad8-190b098feb05", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699522819, "uuid": "94c884e4-1768-4e38-8f59-adcc26fc1897", "value": "384:TOSvEiTbTvpWNcZ0y8fvCv3v3cLkacparAF+rMRTyN/0L+EcoinblneHQM3epzXY:qS7TZ38fvCv3E1cQrM+rMRa8Nuidt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699522819, "uuid": "643d39ea-3b71-4949-a269-1d96fc29bfaa", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699522819, "uuid": "404746f3-029c-4d02-a8cc-e5acc16300e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699522819, "uuid": "0570ac49-cae9-4669-bc0d-27bcc0c4b6ae", "value": "a307642ad8c9ed628244ee2831e141a6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "312d5575-7ea2-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699494556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699494556, "uuid": "b4836980-3c9c-4665-bcf3-65af2cbcb7e6", "comment": "Malware payload", "value": "848164d084384c49937f99d5b894253e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699494556, "uuid": "41eb4dde-a020-445b-aa3a-d4bdc5ff499d", "comment": "Malware payload", "value": "f58d3a4b2f3f7f10815c24586fae91964eeed830369e7e0701b43895b0cefbd3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699494556, "uuid": "4b69a163-8fd4-45d4-b115-9eb16e476bfb", "comment": "Malware payload", "value": "3055ef803eeec4f175ebf120f94125717ee12444", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699494556, "uuid": "945b4c76-1526-4098-ad41-d3d75535786f", "comment": "Malware payload", "value": "16c90da23e058b2edfef67a427cf6ba992bbd58d284a5579f0ef5b11f5918c3673027e17bd5d5cc2044b108150cbc656", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699494556, "uuid": "7b36120b-691f-4112-b606-7c4ee882e285", "value": "T109158C0333918062FE97A5335F5FE7265B7C6D2A0323B52F13981E79BA701B1162E672", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699494556, "uuid": "61bf62dd-0fa5-4d20-9cdc-0b7f89253ac8", "value": "cb0b7e6e83da063fd7c111542603cca4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699494556, "uuid": "131c804b-c136-43ba-b812-86fb94cd319e", "value": "24576:LOo8pEnK4mrqlEZuVZ2HOI+X0l1lMZyYFaeBmyF:LF8p4KpqlEZeXI+X0TVcae3F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699494556, "uuid": "b496d5da-06fa-495f-a7ff-265f37138e17", "value": 946784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699494556, "uuid": "feb7c4c6-9853-4fa9-829d-92327d972771", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699494556, "uuid": "5940d93e-a4f3-48ba-a4c5-ed504ba663de", "value": "Beats.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff7104da-7f34-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1699557609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699557609, "uuid": "294a2981-756e-4242-8bf6-4387accfb318", "comment": "Malware payload (Formbook)", "value": "109d9c88106154c45ff4756d6a89970b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699557609, "uuid": "0a477bdb-9625-451d-8a30-d5cdf62f2a54", "comment": "Malware payload (Formbook)", "value": "f797e394559b216d6a6fbd4ef0ab89291e495fe1b5aad152b50fbe5874b21f58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699557609, "uuid": "281c3a21-6a89-479e-bdb7-902f89928e02", "comment": "Malware payload (Formbook)", "value": "f31a404223bcc2cb3328f5c9ce0570a7df08bd56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699557609, "uuid": "ff80ebc4-a01d-46c4-bc57-f35d1799ead9", "comment": "Malware payload (Formbook)", "value": "120b6ffe438a532fe42bf752ed9d49185072b957d11f9e523ccd13bc4f2906f84d6d5960ff5d937755d4dc7c3864288e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699557609, "uuid": "08da70de-6b07-40f7-96bc-e58b0e59f84f", "value": "T1FCF4273D5A680267E064DFB1CFD9991BB1D0587B3081EFF4A49237278782B56E4E213E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699557609, "uuid": "6d194fea-b058-43db-9c42-71f7c37ff73f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699557609, "uuid": "7bd26915-74a9-4999-9c87-94cdedd807d9", "value": "12288:zixDWnHhX8+CAbT8FLT+6ftX97SXPIoccNZ9BKM:ziJ8X8sbTyCAtXZcgoDD0M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699557609, "uuid": "c7dc5fd0-6ce9-4469-ba98-92045f8f44e5", "value": 740352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699557609, "uuid": "127b00ec-f81a-40a4-9f7a-0fbf3e04e7df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699557609, "uuid": "2f9f7b8a-36f0-4da0-a9ec-13c6a650fece", "value": "Receipt PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "068459f1-7ece-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699513383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513383, "uuid": "873696c4-985c-4e46-9fb6-a26d0aa088f8", "comment": "Malware payload (AgentTesla)", "value": "a5f61eb77bfaf4f80fcfcf72bb604662", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513383, "uuid": "d9382a35-2258-4fef-94b0-8c12a4c5d233", "comment": "Malware payload (AgentTesla)", "value": "f8cb7f91f6f13065c7fbe56a594f4a47698ea2839de8883888b33f869c1ca5af", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513383, "uuid": "6ce56408-8526-4c4b-96b5-aca12bb53c86", "comment": "Malware payload (AgentTesla)", "value": "ed922a79cb04f6cacb673dafdc8ccc1a7840b177", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699513383, "uuid": "4688f6e2-7c64-4520-bfe3-66918d010e8f", "comment": "Malware payload (AgentTesla)", "value": "b61d17ba441a6f4c4c2acec43ae90d01e034fc07756adcec88f18dcd81dfee5eaa5781cde2b698b7237f2fcba59582dc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513383, "uuid": "3fc0d4d0-684e-46bc-844f-1d834c8d2ae7", "value": "T1A1457D193678932BCD4DC776C1D0582497F3CC19A2D7D76A9488B0F92A32B3CAB1B197", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513383, "uuid": "d70d6717-d6bd-4dde-ae8d-52c977c08409", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513383, "uuid": "8d5c99e3-8050-4df3-a934-f6a2f77bf941", "value": "24576:f1yGKSLmJ5SwPh1zGm3oBXFgq6J1txfqK:jMrbzfoZm/7n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699513383, "uuid": "f7bee03a-e81a-48f0-838f-6f869767ffbd", "value": 1262544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699513383, "uuid": "f7790b9d-d74d-41b0-8000-016a97cedd93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699513383, "uuid": "e8115200-c2a9-42cf-8a46-1d7329dc4259", "value": "QUOTATION_OCT9FIBA00541\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04605378-7efc-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1699533136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699533136, "uuid": "5465110b-1643-493e-a730-a3ecf2334de0", "comment": "Malware payload (GuLoader)", "value": "e5f71c75b37416d9ada817b59adcbc75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699533136, "uuid": "eadf2c4b-394b-45c8-b76f-461f7dfdeb39", "comment": "Malware payload (GuLoader)", "value": "f9ed067e08b2d9e267418c8832a356753bc3495c0eaa488212d74fd5066e5900", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699533136, "uuid": "6df76499-a6a0-47f4-8d6f-145396a49acb", "comment": "Malware payload (GuLoader)", "value": "43726fb3ee152ba10aa5bb65a1cebae01a0daba6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699533136, "uuid": "502b38d6-1b36-42f7-83d4-d99206b1dfb5", "comment": "Malware payload (GuLoader)", "value": "e2695fc3e134b4166495744e18762b04e51ec7b3433855687da700b318d67319c2c5ee4ab4e97211eeb03e8a42fb1a35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699533136, "uuid": "5d517708-bd2e-4e9d-be26-bac4fcc37b78", "value": "T1F0B4F104783DD1F7C439BE3B8A89465F1EE01E8431166A0EBBD0772DBD76F950E4A289", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699533136, "uuid": "7f4dda9c-f727-4cc4-80f2-25f65c679265", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699533136, "uuid": "96dc4adf-6049-46a0-8916-f9785f141f02", "value": "12288:cVl7xI2ap5h9xrjb/hV3PEOxEGcl9VHeH6fz:cb7xI2ap55jFVNsXVHc6fz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699533136, "uuid": "e17a584d-f8cf-4d8b-bd8b-0bf81eef73db", "value": 505902, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699533136, "uuid": "39eeeb0e-b5de-4eff-a9c9-441725c24027", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699533136, "uuid": "8a0967b7-2ecd-4236-a8ec-da6f51616575", "value": "f9ed067e08b2d9e267418c8832a356753bc3495c0eaa488212d74fd5066e5900", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a2d29b9-7ed0-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1699514302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699514302, "uuid": "b147f7c8-23cd-4303-a651-df121ac245c6", "comment": "Malware payload (GuLoader)", "value": "e8aa21be70dc98b38262932fc77293c2", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699514302, "uuid": "962e86c0-1ac8-4a93-8377-bd74a9580bf5", "comment": "Malware payload (GuLoader)", "value": "fa3ec548560deebe59eb1c6fa90e1b572264e25b8566c8ca4e8a4270872e3471", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699514302, "uuid": "7c360a1a-8b6f-420f-9177-d3710648a06a", "comment": "Malware payload (GuLoader)", "value": "19413c5373b653712ce7dd4c3b003498e20188fe", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699514302, "uuid": "9deb4cfc-cee9-4e59-a057-2f269a56a16b", "comment": "Malware payload (GuLoader)", "value": "37c061fe2b6929de8a65eee8fa9ae9dc8f729182da1cc5ffd56c7d2ceb38813cebf1f1aa0b24654f3b98fcaa18689960", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699514302, "uuid": "5147edf7-f700-4e26-9d17-594781d7e21f", "value": "T1E2636CB2EF58161A4D4F279DEC41C851C5BD81292922016AFEDD43CEA10799CE3FEB1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699514302, "uuid": "3f50f846-76f8-43f5-bf1f-f92e3a53c9cc", "value": "1536:8N7toyGOJ9/5F+anVHmIqxnxA+hLndxG1javcb2YV9:i72XOJ55hnVHz4vxG1javWz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699514302, "uuid": "3129749a-da83-48cd-8958-31005bd2425e", "value": 68279, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699514302, "uuid": "3a382eab-6b5d-4c1a-88db-1c7de8b8767a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699514302, "uuid": "f325c693-3c56-446d-ba49-873b59101133", "value": "DATA SHEET_SSHN1\u00b7pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a5e2b74-7f55-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1699571479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699571479, "uuid": "dbe85521-5a0a-49bd-b6f4-3447d256c8d0", "comment": "Malware payload (Mirai)", "value": "4cfa20396449ea99e188373091053bc8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699571479, "uuid": "951867b8-dc21-4d90-b214-9c82f3667835", "comment": "Malware payload (Mirai)", "value": "fb5531473087be6d773dcdb6213f9124632707c678f4c089e177ab388bf73801", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699571479, "uuid": "a162b00e-8ee8-411e-bacf-748d107a987a", "comment": "Malware payload (Mirai)", "value": "9187430fdd7b5e920a425fe5474fbd8d5ebb804e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699571479, "uuid": "dd78a781-9285-4add-9466-51fd34fc21e5", "comment": "Malware payload (Mirai)", "value": "5bf756084796095870fd4354ed452df07570824acddaf80be6261c84b5cc6c8286c46be580935b4e03e95dfd5b14ab87", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699571479, "uuid": "30e835c4-4d7f-4819-8b82-0cc5fc607b77", "value": "T146735B35B9762A27C1D1A43A11F74B11B6E117CE3AE8C61E7E720E5EFF206506013EB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699571479, "uuid": "2424690d-e17d-4535-991c-955ba58db28c", "value": "768:EYao5wB7N3voa5q9/R3jzg9LgAfW0zqJwglJLRmkTGRxSGibO+z8sL4y:narB7N3voa5S/R3jzg1gR0zqOky+Wy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699571479, "uuid": "7ff83b9c-9ce6-4f42-9d02-e6bc823ae843", "value": 76184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699571479, "uuid": "aba64a9c-4e2a-4560-b792-ec47142cbd50", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699571479, "uuid": "1a85dfe1-1501-4cb2-bb9f-5b5b4fb91bc3", "value": "4cfa20396449ea99e188373091053bc8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a53b50e-7ecd-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699512987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512987, "uuid": "2e4caf3d-f55c-4ff1-ba42-49de55b08100", "comment": "Malware payload", "value": "9dfe07b53c90ec987df7dda72ca2a53e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512987, "uuid": "91f4eb04-d6ff-4869-ad72-9cc3f381991c", "comment": "Malware payload", "value": "fb8752690c2f6a27047c088e00ce9d3076237ed869a5f3098e1a51afb9151175", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512987, "uuid": "f8d60f5c-bbde-4928-b692-efd5684a17fd", "comment": "Malware payload", "value": "d1bbb46cb42aed78f12c6b8fe2697fe05a82007e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512987, "uuid": "81cff2e8-21cc-4255-b1b0-d8b8d5dc8f2d", "comment": "Malware payload", "value": "f98d07e58aa05ba6c252d6e66fce2e421be822d3d1ebb341592768a3c7eb916733b16f7b900810be443df99aadf87e6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512987, "uuid": "4729bdc2-035c-48f5-bb14-aba7045a6817", "value": "T12FA22988BE5EC897C5AC167D58F607491778EF2BF481EB0F5E8C62291A633C154E02E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512987, "uuid": "49e24027-bf46-47f5-afac-cc7469f78b9a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512987, "uuid": "5662edf0-2f36-48ec-9691-a5f24338d60f", "value": "384:l2fRR0M95vn7gGdQ8IMkOaXYs1xFLviiay9ycyrsR2vZx:l2fRR1vvQJvlfycyrsR2vZx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699512987, "uuid": "d969b818-cb95-4cab-84c8-32e5660b8fd9", "value": 21504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699512987, "uuid": "0d660876-c43e-4405-ab3b-921db6dfe60b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512987, "uuid": "76974a0b-ad9f-4308-9e3f-e58d114aa4a9", "value": "Product one equirement -1.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0966a32-7ef0-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699528325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528325, "uuid": "98c6c37e-5179-4645-b83a-73b5db86c4c1", "comment": "Malware payload (AgentTesla)", "value": "b92ea35eb18c82bbaeb69e3e0891b570", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528325, "uuid": "62bc1451-b57e-4661-97a6-fce2adf1ceae", "comment": "Malware payload (AgentTesla)", "value": "fc22ed7c5dcc1f06dbac7db1faf24de032912a8d8c18c3b715f64454fdd30413", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528325, "uuid": "70d16ece-7f61-47f1-aec3-b49c28c4682c", "comment": "Malware payload (AgentTesla)", "value": "b4c37620912bb68d5385d53cd486485bbd82bb9d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528325, "uuid": "a5c4fd8e-f06c-4937-bfa0-3ed5c1015640", "comment": "Malware payload (AgentTesla)", "value": "25b5c406ef6c41d0f0cd84940ac077e814e65b184814e4bd5361efd931cffaf2e947ca0d26b202730a02dbf066895925", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528325, "uuid": "851dada2-22e4-457f-b502-6727b58bde53", "value": "T147341F037E88EB15D5A83E3782EF6D2413B2B0C71633C60B6F49AF9618516526C7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528325, "uuid": "b48505f7-1ae6-41eb-ab1e-6dc34c401344", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528325, "uuid": "18ed00f4-fe99-4b54-a2ae-f3be24906ec3", "value": "6144:y3HypafSxvLDT7LeHV2pCyH9xZFqAFBv:eypafSxvLDT7Le1G3ZQA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699528325, "uuid": "366433f2-df09-40cf-af09-115012268c92", "value": 242176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699528325, "uuid": "25663f68-b444-4973-9459-6d6f9b42e596", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528325, "uuid": "4e0a44b0-0e53-4c07-8153-f422278a7533", "value": "fc22ed7c5dcc1f06dbac7db1faf24de032912a8d8c18c3b715f64454fdd30413", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cb110d4-7f56-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699571832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699571832, "uuid": "d21b4359-fc97-45ec-ba6f-3d9e032c2f8b", "comment": "Malware payload (RedLineStealer)", "value": "0711e354663288f74e6e00847008c329", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699571832, "uuid": "8b4e5aeb-179b-4cf1-b12e-adf40d3f3499", "comment": "Malware payload (RedLineStealer)", "value": "fda401f30a42eb82a17fbcf5c16b067fb38ac254377bf6d2e87d3b8dea947ed3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699571832, "uuid": "48150ff2-b3b0-4243-a53f-894fa3f42bb3", "comment": "Malware payload (RedLineStealer)", "value": "6ff33d4f143270e58efbbd5c9bb78ba7c383a126", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699571832, "uuid": "c3213420-2c83-47dd-ba7e-8b553499ccd9", "comment": "Malware payload (RedLineStealer)", "value": "18504f158412cec9e10bc5dce23ac670ed33b31915e0bbe53a2147c4a5e1d0861a973e3c482689925b8b6a0ced731d8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699571832, "uuid": "05a1ecb5-6fc0-40ee-86c2-65c4d1b7c2f2", "value": "T175B41242EBE850B2ED7513F018F702D31A3ABCE19974432B33C9985A5DB36C9953572B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699571832, "uuid": "58a93bcc-52f7-4eb3-9b10-b4896a688597", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699571832, "uuid": "acf9336e-dfc6-4e14-8fc8-99e3cee05d80", "value": "12288:LMrMy90ANG2zgZSgMw7rMZLL+Y8TUs2ouP+4+wSRWFcfch:/yTG2ziroKYSz2ou2USgGfch", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699571832, "uuid": "880aac74-08c9-4d2b-9101-a0c90c8dab8a", "value": 523264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699571832, "uuid": "1c150a71-0f4c-4b3f-8c88-7ecc5ec28b9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699571832, "uuid": "e561d6ba-ea13-4aeb-9680-fcfaa1384ad9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28a5a76f-7ecb-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699512152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512152, "uuid": "4aeda7bd-ffff-451a-9040-bcbed7b8e84c", "comment": "Malware payload (AgentTesla)", "value": "3c80e835bd56830bd4bc943928bb8a85", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512152, "uuid": "cf838676-8826-480f-9724-6133b7f6c0f0", "comment": "Malware payload (AgentTesla)", "value": "fdf0ee91f641ab4d55e25928ba08e37611aeb783f0c157e412ce165496eca24d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512152, "uuid": "d7aaea46-99cc-42c6-a976-a0b1cc7e94ba", "comment": "Malware payload (AgentTesla)", "value": "6ac7bcf1a0ab03f20a88b713f193803eeb092bf2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699512152, "uuid": "6a1b9061-c1b9-4a5e-8a47-86394d61a42a", "comment": "Malware payload (AgentTesla)", "value": "af0c1e3e5552b2460154b29e408b8f7e4e4d81f1523a65ab5f90dad35194b9d1029c6e1fb37776dabd762aa6b2ca61db", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512152, "uuid": "3fa329c9-0e68-4b83-a997-a74334bc62f0", "value": "T1A845CF03A8408B87D41D83F46EA34EE91F1ABF08EA916ADF11297F1F3E706721D5A51D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512152, "uuid": "9dbf256c-81e3-4f4a-95b7-4418897284e2", "value": "24576:buBSw6/uZyJ3bVpw6/WZyo3bVU5R1yhNKIlhT1z:G6/4I3bVi6/AP3bVU5R0hNKIlhJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699512152, "uuid": "f545eacc-59bc-4451-8e0f-b40ec7a7d924", "value": 1180160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699512152, "uuid": "3b213eb9-9aa5-4930-a931-b9209af054dc", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699512152, "uuid": "2078f67c-cd96-4fa5-bf3a-60388dd3f9cd", "value": "Order No. 4800014530.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a67d797-7f46-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699564929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699564929, "uuid": "d5a11463-b741-484a-9089-928073e00ff0", "comment": "Malware payload", "value": "5d66e02f3420c82b3dc33ab65aaa2dc1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699564929, "uuid": "39caed52-2797-4953-a0ae-4afa890f06b6", "comment": "Malware payload", "value": "fe00a99d60913aa9b9474516ada33cfccbddac430e9aed9e35da5ace35d0df99", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699564929, "uuid": "68fe56b0-4adb-4dd5-9bee-0251eb00439d", "comment": "Malware payload", "value": "59379993fffe25b96d9604c5c8c776f3e4b9efd2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699564929, "uuid": "d1a94a31-de3c-458f-93a9-ee57be048c6e", "comment": "Malware payload", "value": "c47377c8b145a68a5eebcdc4c8322dfe789fda2118c17f937dd48b28c8f2b339c7e33f57f0c3e8460b63c8186f2429b3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699564929, "uuid": "9bd09949-1d20-40a7-914d-76a786bbecb5", "value": "T182742A0B7AF1C937C0EB5B300CA67AB47E62F8325E4086475E55DB4EE8EA140FE13965", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699564929, "uuid": "87c71a9a-e2b8-4f25-8710-719c0a1f0bb5", "value": "deba71fcd4e68e93af678f2a5e291977", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699564929, "uuid": "110011c9-2560-4c31-ac49-f6ab9c348cc9", "value": "3072:0HDp7pRuKjsir5HZFQGrsUwF7hplPoutjg+QHmCvyoUZE+8r/7OqO8W:+RR5rhZFQGrsUwF7vlPoS0sEx7Ol", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699564929, "uuid": "d9c0712f-20a4-4c94-a5ca-a60df0794b36", "value": 358948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699564929, "uuid": "f1741530-65b1-49a2-99fd-6812aead1ac3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699564929, "uuid": "455aa401-5c2d-4043-b670-bc02d1461c41", "value": "SecuriteInfo.com.W32.Agent.NNJU-2136.3825.7046", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c5ce1a9-7ef1-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699528506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528506, "uuid": "284c4017-6b65-4c5d-9070-f36a53125c67", "comment": "Malware payload", "value": "2018e853148de0164d2e41915ff9dd9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528506, "uuid": "a4d64e51-612d-4417-8a1e-6de8b35d87ea", "comment": "Malware payload", "value": "fffc196c9db75fd58af6f197500f3751e16bf8c031e65bddd4a9ef90c6bb3f42", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528506, "uuid": "d3e7d63b-5e29-4e67-a7f2-4a659758bdf7", "comment": "Malware payload", "value": "5855da471a99143fc1642422aa857cfe837cb3a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699528506, "uuid": "7b6b232d-2ee4-432e-ad85-9b3ba63c8e2d", "comment": "Malware payload", "value": "da9afdf8f16d252c3179c6566dc3e5ddd81f311943e5a5728a7e1203f3831039189c335b09672721fa8ea15dc88c5779", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528506, "uuid": "70212842-d1ba-489d-8dfe-f77cf096f53f", "value": "T12C74F6BCDE4095DEDD829178D5067BB3EBAD221493E820DB2184B769587C9D4C83FB0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528506, "uuid": "eae4b929-0774-4a1b-8405-f637fa91af5a", "value": "6065b92f098e9bf460bfa1a384953b44", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528506, "uuid": "ea331de8-8a68-4802-8212-8d53774e2e40", "value": "6144:aQtdPftek0iiTMfj6yFZ/VF2Hxe73gkTypEkiVwqmtQXbytFi15CNam:aQP+iiu6RX6ypEBVIQXbyni15Cb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699528506, "uuid": "e90b9fb7-6fc0-45db-a4c1-c4f5278d052d", "value": 355840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699528506, "uuid": "6b4d6847-7824-4673-8e54-f4c3c2f3e116", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699528506, "uuid": "412b6ad1-d692-49c2-95ec-5001ad88a806", "value": "fffc196c9db75fd58af6f197500f3751e16bf8c031e65bddd4a9ef90c6bb3f42", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }