{ "Event": { "published": true, "date": "2021-09-21", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-09-21", "timestamp": 1632268981, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "97d50a31-7442-46e9-8d25-d6e6c9bdb7a5", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d49f74b6-1b1a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Pony)", "timestamp": 1632256259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632256259, "uuid": "6638d5c1-4b0e-44d1-82ce-b6220136b7ce", "comment": "Malware payload (Pony)", "value": "1bd3af0ad6f5f9a62c7985a10af1b516", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632256259, "uuid": "4663357a-4e5c-4d23-a5e7-13e7dac45bf2", "comment": "Malware payload (Pony)", "value": "0073ac21688a76d58b1da9bdf08989053248d9f941a69c70655d021b68459d08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632256259, "uuid": "79e7edc3-6295-4102-b83f-0904b16b5b89", "comment": "Malware payload (Pony)", "value": "19866acd6a3e3022ee09ecc6a89e56d42fa8bec3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632256259, "uuid": "f6a8bff1-82c6-484f-83ef-0b7d67a349ef", "comment": "Malware payload (Pony)", "value": "d50886815a7fd07f4cbd75f8681c7706180b3253323f0c2a8503b707e0794346e4c815515709d9d4f6f4e1b78291feff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632256259, "uuid": "fe672e9e-9b52-46e7-af51-6a824556120d", "value": "T1FAA4E123D5A46998FDCCCE7048D5F0D723260A324C6C1A7235DA29811BF7EA36767C79", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632256259, "uuid": "6ad63da8-8758-4b2c-a0fe-06f75d7ef675", "value": "aa867f535282190d30b6010daca64dcc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632256259, "uuid": "e295abcd-0457-4aa6-94ee-b850c8203cf3", "value": "3072:x+qztadKGIYs9pk+nkQmADiuW4iaSXq2O4Fw5YfXsbK4Bw6AbgNMbu6l8moDAM:x+4CTIYkpxXxW4iFXCRK4BwYc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632256259, "uuid": "f2c47446-9ae7-4447-8294-ea9476ea9864", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632256259, "uuid": "b19c6679-d1e5-4ca4-bc58-2c0e2c7b1eb9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632256259, "uuid": "d0ddc69f-32e4-42f9-8538-ce6d7c464aa2", "value": "0073AC21688A76D58B1DA9BDF08989053248D9F941A69.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6910e76e-1ae1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1632231597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231597, "uuid": "48631350-7e82-4af1-b151-4cb9f4466b75", "comment": "Malware payload (Smoke Loader)", "value": "edf0de2af0aab2a35a4e9288299dc64b", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231597, "uuid": "4024b495-7bf0-47b5-9db9-40d9b1a3622e", "comment": "Malware payload (Smoke Loader)", "value": "00a3e533b00532321ab494a8006817dccc12f24b44839d7913267d0855d45adc", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231597, "uuid": "6a6fdca6-6c7e-4eed-98cb-66b15e57a936", "comment": "Malware payload (Smoke Loader)", "value": "cc18341976ff7253ebdaa1d1b2f1330cb67f6cb6", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231597, "uuid": "9ab0ba8f-4bdd-42f1-a975-9a798a87387a", "comment": "Malware payload (Smoke Loader)", "value": "a6b03dc82e95eb5074bf8166c3c26c6f268b7d88a3f114ae340938335608fc5614a48901b365a4e67bca753c45d2b510", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231597, "uuid": "9afdf2a6-671a-4767-a41c-b8e17a9db406", "value": "T163448E20A6F0C075F5B712F849B69BB8A93F7E716B2091CB12D526EE66347E49C30347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231597, "uuid": "101a04b2-d9f3-42e3-8362-814d880feafa", "value": "3a5e62b58b4a57118c6dbb55f27570fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231597, "uuid": "a53b6a8a-3651-495c-9dd3-026a1935c285", "value": "6144:hQ/ARG+8XCcfgLJOpgCeWfPHOswwS2Pw1Osg7V:Wm8XrfgLaveWf2732Y1gV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632231597, "uuid": "b698f0fe-c039-46a8-93a3-4c82dfe99de8", "value": 276992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632231597, "uuid": "a987ed20-0926-4e54-a299-5c8d1266ad8c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231597, "uuid": "44a5db79-65ca-4926-a2b0-173f96458b30", "value": "edf0de2af0aab2a35a4e9288299dc64b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02201257-1ab6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632212956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212956, "uuid": "c0843ca7-b77f-45ac-83b1-38bb833d773b", "comment": "Malware payload (Dridex)", "value": "90ffc7cb3f76d8bb4e8576a28b93970e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212956, "uuid": "ef5cc760-2386-4e43-8d94-7328aa772595", "comment": "Malware payload (Dridex)", "value": "015347df6c062f842a8b452f2089c81ede19f8808a497deb6b242c5560901e38", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212956, "uuid": "74bfd193-7e5c-4d43-95bf-553100a692a2", "comment": "Malware payload (Dridex)", "value": "4a59a0e9aaa28b40bac3564cdfc75de8e903c2d3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212956, "uuid": "9465b582-308d-4083-a1b7-e69632079feb", "comment": "Malware payload (Dridex)", "value": "4d88e9070e2b050ce518fc9b9e9e29073fc164c5f6f338edee7998eab5cb4aa401e0a44505ebeee590f5c4681a2a0150", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212956, "uuid": "8c03158a-7dda-4a46-961b-89c22ea1fc4a", "value": "T1D5B5D020EE69E1E6C6B89F3E9408352727F93D75110D608CC392704F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212956, "uuid": "6d3a11f2-8918-48b5-8e61-633ca259d99c", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212956, "uuid": "77b6ff64-f66a-482b-8bd9-ab0fa66e0e8e", "value": "12288:wVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:1fP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632212956, "uuid": "7564eac6-14aa-4d63-8f85-8d28fc7250e8", "value": 2367488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632212956, "uuid": "444fae34-afdc-4b84-b2bd-1092a516af51", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212956, "uuid": "e0722bef-1d4f-4686-a46d-0636d9f26962", "value": "015347df6c062f842a8b452f2089c81ede19f8808a497deb6b242c5560901e38", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7641731-1ab5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1632212804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212804, "uuid": "5422a4c6-c529-411a-a8d7-4adf65f9285c", "comment": "Malware payload (njrat)", "value": "3872b7d9cef4d1df04866406566dc610", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212804, "uuid": "1b5f769c-5b4f-417d-9637-c6d45d8b85ee", "comment": "Malware payload (njrat)", "value": "02e942f8c34ceff45b57b50cd0790d3139c4903c6aec68d434e97e9c334dc76c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212804, "uuid": "e88db9a1-85f8-4cdc-ac0b-17a6e26a0b2f", "comment": "Malware payload (njrat)", "value": "7927739474fa15d9257a88aed3e6ff4b7f71d35f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212804, "uuid": "c678fad6-1c4f-4bd8-84e5-530a5ec127bf", "comment": "Malware payload (njrat)", "value": "11da4cfb3f414d3b6c734d3da12d04903f5c990f07dfcc9e88dc0d79e341914caa651db8d96fb7b352bb24a047218ef4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212804, "uuid": "7d950cae-dbce-4d6b-a30d-7301fdc296de", "value": "T122F53312FDD120B3D6B55C715934A6A2673E7E100F66C9DBE3A82E1EE8340C0A7357A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212804, "uuid": "5b301ae2-7c6c-4732-a3e0-85cc3c45aef8", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212804, "uuid": "dc32b907-1370-445b-9760-dd8cf4763f93", "value": "98304:JRe6L2b92pKOwFsPcv1sRgbecY3kusDZR+dgP/:ua292pKOwFOX0bdR+2n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632212804, "uuid": "96db81ab-f4fa-4a1d-8417-04529546735d", "value": 3616892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632212804, "uuid": "bb8063ec-e702-4b7c-9e97-20d195fb1232", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212804, "uuid": "b2e6a4d5-eca4-4c3e-9f5c-2013b0189e35", "value": "02e942f8c34ceff45b57b50cd0790d3139c4903c6aec68d434e97e9c334dc76c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dc21bde-1b10-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Turla)", "timestamp": 1632251818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632251818, "uuid": "3cb48891-8490-4f9b-bf01-e1bdaf818d14", "comment": "Malware payload (Turla)", "value": "028878c4b6ab475ed0be97eca6f92af9", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Turla", "colour": "#0B844B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632251818, "uuid": "453a2171-2c36-48a1-8c55-982f45fda886", "comment": "Malware payload (Turla)", "value": "030cbd1a51f8583ccfc3fa38a28a5550dc1c84c05d6c0f5eb887d13dedf1da01", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Turla", "colour": "#0B844B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632251818, "uuid": "b94fa10c-a871-43d0-ae43-8826e8eca86d", "comment": "Malware payload (Turla)", "value": "02c37ccdfccfe03560a4bf069f46e8ae3a5d2348", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Turla", "colour": "#0B844B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632251818, "uuid": "fe76b1ea-ae13-460b-8dd2-38b55e51216f", "comment": "Malware payload (Turla)", "value": "bd40104ef7f8a24146cb2b214152412d7b8b235878c4e4de738e08196a33a079b020ccdaacca52887c21ecbcaab439b8", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Turla", "colour": "#0B844B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632251818, "uuid": "e99ffbaf-8830-4040-96b0-deac8294d6da", "value": "T1C352C86AAFD101F8E47BC13DEDE40913E37674205771AAEF413186092B32BE7A53875A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632251818, "uuid": "106a5cd6-b6b4-434b-80f9-2eec6c1f4e1c", "value": "9f1a98b39d950e17c63cf0201b6879de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632251818, "uuid": "65f80028-ec5a-47d6-bce3-96f997423db9", "value": "384:0+WcSZYbFzygpHURjqiWIi++voQIINWrrRW:RXp0RrH/IGn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632251818, "uuid": "4332c234-df01-40f0-adb8-aa175876b6fa", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632251818, "uuid": "b50d61d3-ce58-4549-87e8-3c307562fbcd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632251818, "uuid": "25f4ae21-db5b-4ac1-98a4-055bce4a1a2d", "value": "030cbd1a51f8583ccfc3fa38a28a5550dc1c84c05d6c0f5eb887d13dedf1da01.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b9a5cff-1aa4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632205482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632205482, "uuid": "df280c2c-6404-4cf8-b099-797b70a8be40", "comment": "Malware payload (Formbook)", "value": "0e8c3b96d1096ad8b19f68d029b0c4e6", "object_relation": "md5", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632205482, "uuid": "c4ea45c2-8197-4833-9e3b-8147f105f83a", "comment": "Malware payload (Formbook)", "value": "035384fd343cd402b110baf54a0d0581bbbb0227d68966091a1da5171a7db73e", "object_relation": "sha256", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632205482, "uuid": "1d69b47f-27d3-4541-9e9c-efcd1b67610d", "comment": "Malware payload (Formbook)", "value": "5f85e3ce262361bdf9ae62e68b870c3c8d786507", "object_relation": "sha1", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632205482, "uuid": "0ff08da6-558d-4ace-837d-1febd76a4b04", "comment": "Malware payload (Formbook)", "value": "d030fee4c78e9424909d7852bca3e5e6a67472be3ff0b3696187407041c1afdf8168fda9732f23ac85a49a2e3c776631", "object_relation": "sha3-384", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632205482, "uuid": "8bbc4159-ba04-4fd1-84d8-211c8768c153", "value": "T14E159EC43943B49FF4DF99B3886E8C2051606DAE4216C33E2143362B99FF353755BA9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632205482, "uuid": "92d3eaf5-6125-4427-a5c2-21fbbe436da9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632205482, "uuid": "08394297-638b-4c5a-825c-843c81bc83ff", "value": "24576:VbQx+FoRKDhyUQ1MA5RuDNVITm35XRZK:ux6oyMFMg6NiTCFrK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632205482, "uuid": "e4f49d91-1b5c-43b3-b6ec-7a3337f22217", "value": 934400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632205482, "uuid": "337b06e2-5445-4709-9847-5ae730d9e713", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632205482, "uuid": "b2f5d49e-1a1d-4a42-b52f-3ec01290328a", "value": "Cotizacin de materiales_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a642d948-1b09-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632248879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632248879, "uuid": "8d5e0ae7-733a-4840-9197-c6bae53b274f", "comment": "Malware payload (Formbook)", "value": "4f25ed58038558b2e83f18896b245791", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632248879, "uuid": "a56305a1-d873-405e-8bee-fcb05b40e577", "comment": "Malware payload (Formbook)", "value": "03b8b680955c5827b5f80ace4afb923c2a5714cbe1b9ca579ab6f197b8826bc6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632248879, "uuid": "98ec3f58-ca0a-48ab-a4ae-7e1d1fb3caf4", "comment": "Malware payload (Formbook)", "value": "80be9861fa9f10581fc77e0c4a1405dd5042365d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632248879, "uuid": "a1cde3d4-f2ac-4dcc-8b94-30515efd7988", "comment": "Malware payload (Formbook)", "value": "f28e1d36bf97fb19877a78ca1eb3ffea9699ed0c11ae42bbc7af570937154befa9b4848082180ac5ea03c1d33d8fe28f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632248879, "uuid": "38ff6cfe-72dc-4465-81c9-1ffc570c6d57", "value": "T1692568295D2682F7C7DEC63CD04C4FDEDA66ACC3BA954F1AC495FA82127760BE08845C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632248879, "uuid": "d2c6ffbe-e4d6-4720-adc9-62e061e27b06", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632248879, "uuid": "dbb40fd2-2679-42ae-8bfd-a37037da89f8", "value": "12288:/RboNugwGcc7MSD35DbpTg4NhG12rZzGC0TCI5:Zo5ZcRS7DJNYwrwC0Oa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632248879, "uuid": "d121e9d8-2380-49bd-9b21-e9f77d71d570", "value": 1015808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632248879, "uuid": "73e14dbe-2af6-4cea-b3c9-1f6cd946dd8c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632248879, "uuid": "26dd8f07-9966-4946-b286-909650ac30f7", "value": "Profoma Invoice.doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaae9774-1b1a-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632256296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632256296, "uuid": "7e732568-0bc0-4f0d-be2e-c5a3f37a0978", "comment": "Malware payload", "value": "cbee340941c0651f69aeb5b9459f9761", "object_relation": "md5", "Tag": [ { "name": "ASPXWebShell", "colour": "#E85FA4", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632256296, "uuid": "dbacf65f-8ba4-48ec-90ce-09f0eca8cf8c", "comment": "Malware payload", "value": "041719e845c185b084ed154ba5553e8074e5a857890ce7d423285748d1420fb0", "object_relation": "sha256", "Tag": [ { "name": "ASPXWebShell", "colour": "#E85FA4", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632256296, "uuid": "abf02382-cd7a-4905-996e-3861345d4201", "comment": "Malware payload", "value": "7499e841e50a0d55c9e4557d39bec5792af802a6", "object_relation": "sha1", "Tag": [ { "name": "ASPXWebShell", "colour": "#E85FA4", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632256296, "uuid": "e676650c-5d41-497f-8e79-2547a0d54aad", "comment": "Malware payload", "value": "b3f74fb2f6c99af6a70803f34f0ef5527a142c6e7ee1221c0e6c6e840a055ffcb1847ebf2b810c77e9ad6c3da39bea6c", "object_relation": "sha3-384", "Tag": [ { "name": "ASPXWebShell", "colour": "#E85FA4", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632256296, "uuid": "c101b377-b2cd-4c7b-bb93-7641a8d2bdf7", "value": "T1FE6319C81298EFFBC36765A6D7F5D6298E1102608F340CB1E7DF811F958582A4A32F79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632256296, "uuid": "8ba84a4f-fca9-492d-aeac-e7c68382972a", "value": "1536:YYZzFEIkuqp1VagQLOVzocyQAyviQOlHKbnFMBMK6IK8eMD:RJkuqpLvqOVzocyQshAOtfb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632256296, "uuid": "807c4ada-d7ca-42dd-b26d-a160755aed12", "value": 72609, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632256296, "uuid": "dcfdd25b-8126-4847-9b69-e217af26cc79", "value": "text/html", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632256296, "uuid": "53acc20f-bf98-4ae0-847c-19ab03c4905b", "value": "XpmLG1S0.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "876ead82-1b14-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DCRat)", "timestamp": 1632253552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632253552, "uuid": "7b13c97f-cc18-449c-a873-b35860f41056", "comment": "Malware payload (DCRat)", "value": "2475be1a7b73399b745d5414379c097e", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632253552, "uuid": "cfd9e05d-d416-46ac-9701-18aa4af6915a", "comment": "Malware payload (DCRat)", "value": "049e79c4d019081cf5894cc565963f88f8a9e76ca0749d750242692e65b79710", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632253552, "uuid": "b7a029f9-0097-4cef-828b-ee756c02ddeb", "comment": "Malware payload (DCRat)", "value": "33a5819b15bceb3809106b870bf85e7ec47b616e", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632253552, "uuid": "d6bec39d-51f9-4682-8f80-39505ddef5df", "comment": "Malware payload (DCRat)", "value": "c936f70395c8c1a15f91f0aa13477e705884bffa5cefe5d1ab4dc81fe57b499117ca1170cb74cf50e1fd6a302330a557", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632253552, "uuid": "483535ee-aeba-4be6-85b5-92e8471c0a78", "value": "T1F494E0FDB5D41A76E56E96F9D5F0001792FAF00B252CBF2704C84AF81A53F218C94E66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632253552, "uuid": "4c39f412-4bad-47bf-9e8e-6ea98071e19c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632253552, "uuid": "2780a37a-0a91-4f96-9e14-bf53f798dd09", "value": "12288:h7/hpRa44ypHrt8phh37nXnBR1Wl3WaktC54b2sJqU6JlJHLtHQkgiU2:a7Uq2swUSlZlQxiU2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632253552, "uuid": "6c2e37e9-cdf3-48df-b53b-19b95b1e9678", "value": 422512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632253552, "uuid": "a13f0ae1-8f1c-4eb1-a601-222bd41ddb6a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632253552, "uuid": "2c409b12-20fe-4f7e-8e0e-14dc56cd16b7", "value": "2475be1a7b73399b745d5414379c097e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27ddeac7-1ab7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1632213449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213449, "uuid": "ba187b79-712b-423e-be6b-b4a681d3c3e4", "comment": "Malware payload (njrat)", "value": "f5df22a0a21deb1bae571555826e9076", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213449, "uuid": "ab11efb2-fb05-4dd1-9d71-2b1a2593ec50", "comment": "Malware payload (njrat)", "value": "05df8d39bcf7d65dbedad8a9c01f2b225058a3933373cfee185831791f21de9a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213449, "uuid": "0b536c23-f428-4435-86d5-076778d77125", "comment": "Malware payload (njrat)", "value": "f5621b1ee4d1466c06a2a137d46015107aa2855a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213449, "uuid": "0682028a-2446-4e24-b28f-f13c42f65c64", "comment": "Malware payload (njrat)", "value": "1c1b11e589fafcdfb27fb91006aa5d0d38b1a1b12b64440329b9f73af4cbe1bbf5c110c3b11e331b593180357e110263", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213449, "uuid": "f3ef2098-aeb8-439a-a5d8-7b549111c3c3", "value": "T164159E0373DD83A1C3725273BA65BB01AEBB7C2506A1F59B2FD5093DF920162921E673", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213449, "uuid": "a847c4a9-0694-499d-a3b8-91eb55b37db5", "value": "bbac62fd99326ea68ec5a33b36925dd1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213449, "uuid": "1283d0f0-4344-4e1c-a1b6-0c67ff05db68", "value": "12288:d4lsXvtCcmVVXzzn4PJAahPl/QEdIMiVbHydEIJnJWUgaF79Rq9MmCS:d4lavt0LkLL9IMixoEgeaZ9Rq9MmCS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632213449, "uuid": "e3f2d0bc-c64d-4d26-a23e-fce6483a9f0f", "value": 884224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632213449, "uuid": "b28eaccf-2266-4946-a18f-d748d3da0f7a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213449, "uuid": "7b41e834-c2c3-4b33-8f56-0d487d62c539", "value": "05df8d39bcf7d65dbedad8a9c01f2b225058a3933373cfee185831791f21de9a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c70300b-1aa7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632206531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632206531, "uuid": "cd766b6d-5a05-4b7a-97a8-fb1bec76b03d", "comment": "Malware payload (Dridex)", "value": "7da99247e463ff8628f3098907d7337b", "object_relation": "md5", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632206531, "uuid": "a299d954-03ce-46a2-aaaa-fe28414a41b1", "comment": "Malware payload (Dridex)", "value": "065a662e4d1b4e1459595afa49d830ca4ea66b520bd44b7a77b0d67e479eb7cf", "object_relation": "sha256", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632206531, "uuid": "59ef0cd1-ac73-4c33-bb90-6f095a9fa506", "comment": "Malware payload (Dridex)", "value": "d8f1f8781a844547ec185681338af960dcc9e1ce", "object_relation": "sha1", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632206531, "uuid": "ef9b9785-ea93-480a-906a-505f40996591", "comment": "Malware payload (Dridex)", "value": "cb386931769cc8942334ca5ff07019b0dc3a9b76f2e2d272e6b9896eb42929188c1c878ffa3040a92faa01c6ce19e535", "object_relation": "sha3-384", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632206531, "uuid": "34e119a4-5032-4239-834a-80bba27a6e45", "value": "T13714E07ABFFBE0F6C82E82F3417582751859D8349718CA77C6B3F929D4750D462A8C22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632206531, "uuid": "4f2d81d2-65dd-4502-ae2d-a2c183c54429", "value": "f8e5a95d062791486e95dac858f22b5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632206531, "uuid": "c3db0281-6e31-4686-b59a-d7ee95f1e5d3", "value": "3072:P9g3Pf+EEZ8x1ap5V5VSwI347BCbWKep1oAfxkOudNCesqC:P9g3PfK8xmgLaBCbWXNkOE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632206531, "uuid": "112d494c-b0c0-4a25-b01d-f4dbb083e71b", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632206531, "uuid": "f16beb7a-8f69-48ee-874b-05db41ed5328", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632206531, "uuid": "645fe0de-3d98-4deb-b5fd-3dcf575e2368", "value": "7da99247e463ff8628f3098907d7337b.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aabcf09a-1ab5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632212809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212809, "uuid": "2ca7ac2f-e096-4295-982d-d8a3c1fd3e43", "comment": "Malware payload (Dridex)", "value": "807e485b8c6500212fe372fb1a99a79c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212809, "uuid": "e23cdcee-b600-426f-b370-b7705771f921", "comment": "Malware payload (Dridex)", "value": "065fbc9fe1ed977bd77641b7426af207f3e6ad1cc47ee26ee0cd5e66b21ce22c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212809, "uuid": "55420f06-1fe5-437d-b149-38f128c0f84e", "comment": "Malware payload (Dridex)", "value": "8378ea9041a6982f0f091f9ccc2952574fb353b1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212809, "uuid": "289431b4-c0dc-4f37-a5e2-4feda5f6426f", "comment": "Malware payload (Dridex)", "value": "3719807bbe13f72076fcb44b28c152a8722e45494d382742994fb799baf567917f5052eb13b5bfd8cc91fff9f1fa2dbe", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212809, "uuid": "58bc25dd-c502-475c-ac51-d6a5f08e269c", "value": "T135F5E020EF69E1E6C6B89F3E9448352317B93D75110D608CC396608F5EF82546E3F9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212809, "uuid": "d44ecd89-04d1-43e8-a9d6-865107b31758", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212809, "uuid": "6c0510a7-1142-4d58-998f-75a604553ec3", "value": "12288:LVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:KfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632212809, "uuid": "90e4a865-df49-4793-87d3-a2d64e06237b", "value": 3440640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632212809, "uuid": "5bd0e881-5897-4f3f-b3f2-fb2c0653a496", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212809, "uuid": "0d0b92dc-9843-4887-95c9-904c58596363", "value": "065fbc9fe1ed977bd77641b7426af207f3e6ad1cc47ee26ee0cd5e66b21ce22c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7296923e-1aa1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1632204125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632204125, "uuid": "d7a999be-60cb-46e4-9792-f749667432e5", "comment": "Malware payload (Loki)", "value": "598dc6dc615f6d06632fdf69ee7a461b", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632204125, "uuid": "7cc412ac-7daa-490d-9c63-ab76fe23cf8e", "comment": "Malware payload (Loki)", "value": "06acbe11dffdc15bd87e6aefc6d008256d60d97651d73d6ac2c9e7f96344af46", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632204125, "uuid": "398fde1d-a692-4cc2-9ce8-be40bda76ccc", "comment": "Malware payload (Loki)", "value": "548090bfae5e7f3b9b6dc62a237d608579ebec4a", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632204125, "uuid": "660668b0-9d2e-4499-8e8f-e48c0dde6706", "comment": "Malware payload (Loki)", "value": "ecdc2c80b2a1bdcd430610e470e87f950e36aad1a8ee15d096b6b17292568ab8e88e415947f617fdca7f9647e5477e62", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632204125, "uuid": "ca7ac0c2-2f01-4e00-b07a-a28d35b1c994", "value": "T1AB8423A6BA4CBABC9381034CC1E55C80DFD6971B68B6752E17B4E8CCDBC7B0B10C6529", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632204125, "uuid": "124feaf7-9029-40c4-a9fa-191b5bfbcf9e", "value": "6144:ofiXSL8sCXVCMD9W3yGKcokWFTTXIy2SiuIesNz0Qt2lNzTlEIgCluvlrpzOkrCx:o6CL8sCXsMyTKcokYTTTLJsNz0QGNvlh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632204125, "uuid": "995392fb-2c9e-4ef8-96f0-15d1a27e235b", "value": 384312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632204125, "uuid": "e3cfd3ea-ec33-4c87-81e6-9da10365820d", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632204125, "uuid": "9d32d9aa-9305-46c3-8d1e-87d910e43e6b", "value": "dhl document.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c249af6-1a7e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632189109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632189109, "uuid": "f55a19ef-323c-43f1-8c22-f465270cb756", "comment": "Malware payload (SnakeKeylogger)", "value": "369bf6c299a3f847d1734da9c3613e25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632189109, "uuid": "7c359f48-47db-4417-b142-407f82eeda90", "comment": "Malware payload (SnakeKeylogger)", "value": "06d932e13bb45761a61ae724efb9a792ebbc7037064745013a947ad119d261af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632189109, "uuid": "d48c62d2-aea3-4ca8-afcb-052c16371ca6", "comment": "Malware payload (SnakeKeylogger)", "value": "9569c782557fc618118cc9616a473c9c142476c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632189109, "uuid": "d5e290b7-30dc-43be-b5f7-b2de303977a5", "comment": "Malware payload (SnakeKeylogger)", "value": "63571a142b8b3436e7b416923715ba5bb78cfd4a4ee5fd6a521fc15b3abcaaa86d8443912ce65b59815735779726fb22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632189109, "uuid": "3b1215c1-a67f-4af6-b31c-6ba6f6e726bf", "value": "T121A4D0120F490DB7E82C46B3A47760BB4AF2AD73977095974BAEB73B0830606552FCB5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632189109, "uuid": "b6713528-9637-4871-9d52-d69c5d29a5d5", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632189109, "uuid": "9d579318-46e4-4fe7-b49b-6a6df6948dc1", "value": "6144:L8LxBrPmacccbTCcC+B3y/hdTtFm3ZjcrrXcrlzcto0qc/PUI/4h52C5tZx1s2oD:5C+BC/uKcrBcto9Elwh52gq23dfi2l0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632189109, "uuid": "bce5ded0-f111-4e84-bf93-6db1b437a454", "value": 466463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632189109, "uuid": "8e09b2e2-da69-4f9f-8445-d549fe200eac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632189109, "uuid": "3dc52527-280e-43d8-85ca-307fa5fcbc70", "value": "Y\u00eau c\u1ea7u thanh to\u00e1n \u0111\u1ea7u ti\u00ean CHI TI\u1ebeT NG\u00c2N H\u00c0NG M\u1edaI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f4551cf-1ab6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632212978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212978, "uuid": "795902cd-745c-4f69-9b49-60215ee952bb", "comment": "Malware payload (Dridex)", "value": "5150b46ee93aa1f774b4ea98692c5038", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212978, "uuid": "2ffc71d0-d462-4eeb-8e15-5f7d86c71f7c", "comment": "Malware payload (Dridex)", "value": "0714fe33a18c653989a0556de79d0a77f738ce84c1c35b141e4996a5bc3978f1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212978, "uuid": "2dbdb0a4-12b5-4626-8994-7ccd32c3bdb4", "comment": "Malware payload (Dridex)", "value": "eb4c410e6845a327084b64d2e2282af29338d07c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212978, "uuid": "db7fb38a-8a26-4c35-b8d5-2e4197c5a692", "comment": "Malware payload (Dridex)", "value": "1817885db67cdd7b20129e8e584d3536b59b3ea81ee95ef19ab5222163917327e0260f608848025f1ee52ebfc7ba4177", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212978, "uuid": "2f84cd88-fe97-41b9-9996-0308e4e4d6f4", "value": "T180B5E020EE69E1E6C6B89F3E9408352727F93D75110D608CC396704F5EF82546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212978, "uuid": "4bed35fb-0164-4126-8031-16db69ba8def", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212978, "uuid": "98517c6d-fc98-4adc-93fc-2490f5d72621", "value": "12288:ZVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:YfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632212978, "uuid": "a76c32de-9866-4a2c-80ac-305f0c0b9cf4", "value": 2338816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632212978, "uuid": "138b5fa1-7fa7-4e4f-8313-021f38aab4f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212978, "uuid": "17783a42-b03b-4d9d-bd7e-91af1ec50eb2", "value": "0714fe33a18c653989a0556de79d0a77f738ce84c1c35b141e4996a5bc3978f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c218cb12-1ae0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1632231317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231317, "uuid": "90fa8983-93aa-44c1-8d7f-c52dbc80f4ef", "comment": "Malware payload (Smoke Loader)", "value": "f3ea21000f563de2626b2cdc15ce7f83", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231317, "uuid": "d663525e-a40a-46ae-874b-0456416966c6", "comment": "Malware payload (Smoke Loader)", "value": "079edf1175877722f2aaf46802059ef23b7e6d399bde5a77803910e8f13324d4", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231317, "uuid": "b04634e4-7af2-4eda-9281-6a17966fef35", "comment": "Malware payload (Smoke Loader)", "value": "4e46eba13d77fd012d54dbf49a0c32803bd6d715", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231317, "uuid": "910edeb8-e952-48e5-aa4e-b37c9298ab75", "comment": "Malware payload (Smoke Loader)", "value": "fb8be174146162e3386c237cea0b1fba713fafb31d8dd21b6d527421e14106dcd72ef045d5bb8f80aed18bd13aced3ab", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231317, "uuid": "f846218e-4b73-4dab-9714-76c0a1515faa", "value": "T12A447DE0EAD0C035E5B712F999F993A8A93D7D71DB2050CB52F626EE16346E49C3034B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231317, "uuid": "7731fe85-5304-4a46-a99f-3140e64031a4", "value": "3a5e62b58b4a57118c6dbb55f27570fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231317, "uuid": "85731c5d-3876-4c39-85f8-7d988c9ef091", "value": "6144:kWfQmGCz33c0oLgOJgCM3hPhzbR80HVOsgy:Vjz3M0oLxvM3hZx8wGy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632231317, "uuid": "c5b62719-1b69-4d89-845d-3a9561f03d57", "value": 276992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632231317, "uuid": "3d46f7b9-3277-4dc5-a166-00ad9b5694ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231317, "uuid": "8deca357-f1e3-4266-b612-9dec1d8cebf5", "value": "f3ea21000f563de2626b2cdc15ce7f83.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "130dedd6-1ab9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SilentBuilder)", "timestamp": 1632214273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632214273, "uuid": "67331f9a-a172-43f1-ae5a-9f07502eab3d", "comment": "Malware payload (SilentBuilder)", "value": "a07d5ed5b8fa2a17c5368a95bd9e35b2", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632214273, "uuid": "9ba5c07b-f1a2-49a9-8c69-7394681bfa39", "comment": "Malware payload (SilentBuilder)", "value": "0816c3927945f4cc4bb9538e8142226ed332d2e465ea1a803c8dba2cf7b767e4", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632214273, "uuid": "c043b9a0-d4d6-4151-b288-9aed0d969f20", "comment": "Malware payload (SilentBuilder)", "value": "3dd57113084c4563a5b50b5a22ff765b73c94e0f", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632214273, "uuid": "16e083d6-d3ac-46b8-b392-502635f8587e", "comment": "Malware payload (SilentBuilder)", "value": "cc2bcf8cfbb37c05fed3e2db6f4de9e4d659d6ffb897422eff6d0f7d52ceb145333831b8258ae66fb8232aee17f0bb18", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632214273, "uuid": "20e63583-0810-4728-9124-26b4a9323bbf", "value": "T1FA44D02636A5A41DEC2D2B76A8BB53D02337FC504FD38BC77AA772263F726914D22405", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632214273, "uuid": "aa1737de-a5f5-49a4-a570-e3131797b69f", "value": "6144:mKpb8rGYrMPe3q7Q0XV5xtuE8vG8UM+knfb7I6+tqDWcwnoRZzlj+oSGpGvhmmmw:kj7CqScwoRZ9bSXkh/nLKL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632214273, "uuid": "52e1a63d-2393-4f7a-a84c-c3dd5bf3475a", "value": 269312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632214273, "uuid": "efd9644b-4606-45fe-8e01-7bbe22f3bb25", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632214273, "uuid": "3ffab5b1-9c9d-43c3-861c-b0f411552009", "value": "waffle3.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59bb875f-1b04-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632246604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632246604, "uuid": "d5d25162-29dd-46a9-a81e-e93ea468c4a4", "comment": "Malware payload (Mirai)", "value": "7ca5c1fef83342ed94fafd9e4526c3b7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632246604, "uuid": "415ea780-26d3-4b82-a00e-d83caf375ebb", "comment": "Malware payload (Mirai)", "value": "08816e665bfa4b14fb9f24268d34e1778138b803c63718f3a4a07ebc41faa676", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632246604, "uuid": "f7280711-001d-4643-9232-1cee4cc824f8", "comment": "Malware payload (Mirai)", "value": "9a92642042e31a1ca697398d5f680dc70e38d193", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632246604, "uuid": "8e077db2-54d9-4127-bf2a-3a0bfc5152f9", "comment": "Malware payload (Mirai)", "value": "5cc8bb93290b5912a5494952326b0a209499744604d942a7de47c75e78767b821aa97ce21b9c4612ec3d6456fe0fe867", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632246604, "uuid": "55703ab2-8e4c-4dc1-961b-6e562748ccbb", "value": "T17ED2E1D9C8F87730D46E143A05FD344D0A69DA2F92A947E78FC836709417B689C34BE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632246604, "uuid": "8c33f92a-4e40-4d4e-8468-9fd7d96e8f82", "value": "768:PtGbCSU3RcEyxGDqmqKrmrk5gUnbcuyD7UGQRjq8:lGLUhXyxG7Lrd5gUnouy8GyO8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632246604, "uuid": "09a2e79b-33d4-418e-afea-985a676a98ed", "value": 29572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632246604, "uuid": "c0f35fc3-9fdb-4886-b0b2-2ae496ded91e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632246604, "uuid": "754b26c4-c4e3-477c-ba08-eb60595e86a7", "value": "dark.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "755901ac-1b37-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CoinMiner)", "timestamp": 1632268554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632268554, "uuid": "9c976f72-1f39-4c17-80c8-10a9551f76a6", "comment": "Malware payload (CoinMiner)", "value": "e31d911d6f98122680361687db9f5d18", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632268554, "uuid": "bb812571-49f5-4202-8d9d-94f498bd4f7f", "comment": "Malware payload (CoinMiner)", "value": "09228fe3797c2de61f4cc484d22b7eed17ec9cc7d2e722c650ef525def22801b", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632268554, "uuid": "44e7fcf9-d86c-47b7-be42-31601fbdaea0", "comment": "Malware payload (CoinMiner)", "value": "ee12d2060d707fc439bd0ae0a0c407adc2b44352", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632268554, "uuid": "0ca0482f-98bb-49d5-835e-2e76ac889785", "comment": "Malware payload (CoinMiner)", "value": "625bd9c5920da6507ced9adf4429ff182b089ea509dbe92c7829275777188ba3f23c9b4f0bd91d7ed046dbaea09ce26d", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632268554, "uuid": "3c9e0bda-3bcf-4ec0-b9b0-4943bbcfaad1", "value": "T18F447D20A6E0C035E7B702F549B9E3A8A53EBE757B3190DB22D126EE56346E4DC31353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632268554, "uuid": "324cb54c-1f42-4178-ad1e-3e9f9a5a2a3d", "value": "6abb333342201a93de1795b4b0940b40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632268554, "uuid": "d62280c9-4ffb-4e98-8a77-582696728ad4", "value": "6144:ExfsmeqH2NkZALQe+gCdBZLQXv27UZNgEt:WXH2NkZAL2vdTLQ+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632268554, "uuid": "c07814fa-f35d-412a-9cbf-f923655c0444", "value": 278016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632268554, "uuid": "69b1804f-709a-4a3b-95ef-eae2dfbe4b9a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632268554, "uuid": "0f93eca3-466b-4642-a1f5-1dd43556fb16", "value": "e31d911d6f98122680361687db9f5d18.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "477a11b3-1b2c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1632263753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632263753, "uuid": "a0e77b81-7c37-4a89-87ea-f61a663982dc", "comment": "Malware payload (ArkeiStealer)", "value": "295b842a1a8473e51468fed24d1527cd", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632263753, "uuid": "44e299e3-bd35-449c-801e-15a10be034e3", "comment": "Malware payload (ArkeiStealer)", "value": "093c40a96a55be0cc76dd3f234eebc8e66f453626f0d217fce4bb91d5e5afa5c", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632263753, "uuid": "edea218a-a7db-442b-8623-c49de07a30a8", "comment": "Malware payload (ArkeiStealer)", "value": "e781082d1998162c11c2858a7a4b14db110c201f", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632263753, "uuid": "bb065d13-2608-41a8-a2f4-9a916effc66f", "comment": "Malware payload (ArkeiStealer)", "value": "cab6b9c5c2038333e572835c6ec21961741c0cf1aaf51b1132a75eb31fd19c97bbf7cb2e5a5da158bb53ff7a782ab8b5", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632263753, "uuid": "8c3dce95-4c97-4641-907c-97afbb254d33", "value": "T11736335273C1A877DF412674F64C0B32F4BAC38019B19ADBA328964C1F3DD1ADB2959E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632263753, "uuid": "6d8bacce-9c47-470d-b3cc-d31b639d3322", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632263753, "uuid": "4bf4cdaf-c336-4a84-ab84-b76c67497398", "value": "98304:x8CvLUBsgnCa7CUqSvSHV9z2G6xi8FYPWrWyqW1w2kDblQgvZ8Q4y/40z8L8Vi:xhLUCgnCavqSvS1FZ68HPAWyvSD5QK8l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632263753, "uuid": "bb6e613d-81ba-412b-a792-a40dfdde647e", "value": 5292636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632263753, "uuid": "a460fa7b-60c9-4571-adf9-e182fc73e650", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632263753, "uuid": "f9070161-11e8-4366-82a3-521a1c3edcfc", "value": "295b842a1a8473e51468fed24d1527cd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d522b0dd-1aa4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632205579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632205579, "uuid": "791a1820-6880-423c-bc7b-bce6b975739b", "comment": "Malware payload (AgentTesla)", "value": "89ca9629669e2ea00b1faa52bf3671bd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "PRT", "colour": "#27EC70", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632205579, "uuid": "5a59880a-6a3f-4be2-8a20-fa9c11e44ef0", "comment": "Malware payload (AgentTesla)", "value": "0977a8fcfc104e2ab162f63f36e287f7f004f0187fb4c2a9dc0841bfbc4a0975", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "PRT", "colour": "#27EC70", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632205579, "uuid": "9cb4e48a-2a17-4561-b8a4-b3468278760d", "comment": "Malware payload (AgentTesla)", "value": "31d83244a324d25972da3760d5160374118f0bae", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "PRT", "colour": "#27EC70", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632205579, "uuid": "ac4c945e-f886-448a-924a-dbca891d15d0", "comment": "Malware payload (AgentTesla)", "value": "43caea92688bd3035fb8b6c2a30163d198ea4b894d72beca520c2ceab033f97f7a7d12dce944a2c1e695b6943bc44e0f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "PRT", "colour": "#27EC70", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632205579, "uuid": "c26332d5-d608-4c17-9bca-0db954d954fe", "value": "T1EF059DC17D43D89BF4DF1AB398AFC42011656E9D9161C73E3686BA2B55F3302306BA4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632205579, "uuid": "28d68b4c-09ef-4dd0-9dd5-cd880be102ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632205579, "uuid": "7ef6fbcc-f3c3-47b5-b80a-e98dea1d7600", "value": "12288:9GWvissmtiK5oUZdiKMOsVqtqH8nRDInDdoqWpQK:k+FoPKgF9PK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632205579, "uuid": "96c73bcb-e60f-4f73-8deb-b871eed5d625", "value": 807936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632205579, "uuid": "48a16dfc-0233-4faf-9a02-43b9f42f034e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632205579, "uuid": "8986cc57-1464-49f8-91fa-e51d1e20904a", "value": "Lista de pre\u00e7os $ Quoataion form_Zaruk SW00199711021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cf3e392-1ab7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1632213457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213457, "uuid": "cc18a3a3-b206-4d15-bd40-3842967baf2c", "comment": "Malware payload (njrat)", "value": "62d1e40d03fff66fb9f6037e2a728461", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213457, "uuid": "28060dfb-b824-4362-98b1-7a349c799d3e", "comment": "Malware payload (njrat)", "value": "0998d0b25a6e836a7fc4c37b0b58c50cf3d3b7512c1f053eba8a0be514eeaa81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213457, "uuid": "21d1c287-e22b-4094-9987-4792f673338f", "comment": "Malware payload (njrat)", "value": "de0571c954fba38c94c0f029e9bcba9f8e81bb25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213457, "uuid": "ff6a60f8-7392-4ae5-9e98-c238f29f692a", "comment": "Malware payload (njrat)", "value": "81ac7ca807d12ec95c160dd1db66f243ae29f7f3467f4e3d5a95eccc80f6e6b98736b94c37072c488f6a2d5bb82ce1ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213457, "uuid": "0fe52932-afc3-4558-81a7-a9b1e7e1ee7e", "value": "T1462523D3E92D352FDF279073CF26985159D2E864A8ECA3FC816309D5A11FE3E8AD0442", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213457, "uuid": "799e4b68-dfd9-4d2d-a572-a6200239932a", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213457, "uuid": "8786f72a-e8a1-435a-9ef5-dbc74cd7dd42", "value": "24576:9iNnImnMPdyWif7nbLnJDojth739XdDFBOOLn:9iNBMaFkXDFL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632213457, "uuid": "51f2569c-9ca3-4fef-aaa6-d9944306d8cc", "value": 964608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632213457, "uuid": "cf90a941-d4ee-4eff-bb46-d836f6110acc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213457, "uuid": "be52650e-85b0-410f-94f6-bc7f34ba1512", "value": "0998d0b25a6e836a7fc4c37b0b58c50cf3d3b7512c1f053eba8a0be514eeaa81", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f77e37dc-1b00-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1632245150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632245150, "uuid": "11c4ae9d-252b-4571-be99-b49be9b0f43e", "comment": "Malware payload (NanoCore)", "value": "658ac8ac0f4d529733530fa96d78ebd8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632245150, "uuid": "e2407c70-9d8a-40c5-ab4d-b079f239a403", "comment": "Malware payload (NanoCore)", "value": "09dd5a7369587fc8659d161eb2d61b616a37226b7e95864114acf91e2700161f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632245150, "uuid": "558f6821-7b57-4f13-b57b-7fe379fffc43", "comment": "Malware payload (NanoCore)", "value": "daec563c0b43d10b9e2683a0f8944134597862f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632245150, "uuid": "64f9c5e6-4286-46c8-a9d9-4881946f6c46", "comment": "Malware payload (NanoCore)", "value": "8932fdb85b093a92ead88e3c7b612a7e5e3bf14bf79bb0742a5ca7bf495a3ce9b83f8e2510bbb0c39278acfa77d842d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632245150, "uuid": "c4348151-d191-4a81-86db-b0cc8cc34fe0", "value": "T1AFC423748271C570CB5D8AFE1122618D0FB7B29E6E03FB3A5FC260C2AE5BB515120DB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632245150, "uuid": "a1fdcaec-84cf-4038-b9eb-54601e3a9898", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632245150, "uuid": "2f4c7937-92df-4b43-acc0-e37c71a0f785", "value": "12288:LAs4nmtiK5oB2atOX75d2EWm2HItnEIWEx9MSTbw:An+FoB2atOXHQm20rnxmSTbw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632245150, "uuid": "808e12d4-1955-4870-b8c0-4ac8c7889412", "value": 568320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632245150, "uuid": "fb1cb771-c664-4cc0-a198-39c4ea8165f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632245150, "uuid": "94f00501-498f-428d-bfb9-835458601887", "value": "Payment Copy 12356789.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e83607fc-1ab6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CyberGate)", "timestamp": 1632213342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213342, "uuid": "7dfdddc1-2c48-4744-84a8-265d6d3de0c9", "comment": "Malware payload (CyberGate)", "value": "61b1f6822312a8dac71d500e20a45265", "object_relation": "md5", "Tag": [ { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213342, "uuid": "02f7fc33-4604-4871-9028-9397e1a1bab8", "comment": "Malware payload (CyberGate)", "value": "0a15a9e38538dd84980f228542e79759c8027ddaacf320bdf755dcec73373e5e", "object_relation": "sha256", "Tag": [ { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213342, "uuid": "17fde3fe-a430-4b30-843c-80345edfdfe8", "comment": "Malware payload (CyberGate)", "value": "0bf1432f28048a7b8ec74e39415ac7c1155a0eea", "object_relation": "sha1", "Tag": [ { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213342, "uuid": "0ef4f1b0-72de-4004-8bf1-aa3177cad95f", "comment": "Malware payload (CyberGate)", "value": "233b04f68d6ba07bfa3ee54d069924ee91c7c3e7a36681e265059d3ba20165acc6387f6fcb151af6324ae712e7d756f5", "object_relation": "sha3-384", "Tag": [ { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213342, "uuid": "bc44fcdd-d079-4904-bcee-b92ba441767c", "value": "T1EB64123F7278C483F0CC0BB67776769413B3BA842F2B896E2455E65A1F06F11081A65F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213342, "uuid": "98589373-a0fa-4203-921f-879dd54c743a", "value": "0dd13bea6920d3c596b33bd4adeb7215", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213342, "uuid": "74f0cfba-2829-4e7f-a5ab-810db242ec38", "value": "6144:Dhf8OZF0ypnLW+gjuSffr6ZgGstOfw7bl2jXbIAUI5tJ:a4F0ypLW+4uGogbII2/UqtJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632213342, "uuid": "5cb3e65b-cee7-4934-944b-8f7dcc8557a4", "value": 323584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632213342, "uuid": "14ea03e5-25db-4fd1-9371-326661abe95b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213342, "uuid": "5f2f06f4-83f9-4a0d-8592-fa6573ce022a", "value": "0a15a9e38538dd84980f228542e79759c8027ddaacf320bdf755dcec73373e5e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5eb6d81-1ad2-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632225391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632225391, "uuid": "df67fd1c-6a61-40e9-8f63-85c069eb9cc6", "comment": "Malware payload", "value": "2c1fc65ebcf09c1fa1c417aa185e4c29", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632225391, "uuid": "8961d4c8-6dd2-4a78-852c-305ffb61b58f", "comment": "Malware payload", "value": "0aa9c2d22a3b61aee067d381f9e90efa026d5bfce7747f816c72d26decb58809", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632225391, "uuid": "4bde0f88-f8c8-4646-b161-77fca119e562", "comment": "Malware payload", "value": "84bb8d85b3f4b71e488b05808f03c970db637b4f", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632225391, "uuid": "1df66012-12df-4dcb-804f-6c66f7a77ab6", "comment": "Malware payload", "value": "4112935913f38e6f60649d662b9c70145d8ffb99e639fccbcc85d93e0fd6cc325db0e7204d5998be6d3ff1ec3fb12db8", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632225391, "uuid": "8211d5e9-4b3b-43e3-9454-61821d5cf4cc", "value": "T150C2BFF6D8816131C2C294FE96441CFCF89DA079C728779F7569F1258E80883BB8D699", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632225391, "uuid": "35fdc7ae-8a1f-4b7e-afee-733f9429b498", "value": "384:D0lrbpwHoP5I18OQqYRI0Q9IslErMpFSA4SNrElzCgbZHWlVBXfjJHkwv6x:woHiJxqL+MWtSNrEogbZHWlVxfR+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632225391, "uuid": "4eaf5342-8d28-4117-9661-521b59ff3238", "value": 26113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632225391, "uuid": "c825fe78-e60f-4104-9cb1-4ecb368f8539", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632225391, "uuid": "dabf84ce-9ea7-46b2-9e26-551b77042599", "value": "DETERMIND..docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e43aa1d8-1ab5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632212906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212906, "uuid": "99967617-5406-4f75-b3c2-9b770ce10ef3", "comment": "Malware payload (Dridex)", "value": "acbb70d0bee315a0aed63a1fe2c95521", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212906, "uuid": "f06e1d2e-e398-48da-86ea-a453028d43ea", "comment": "Malware payload (Dridex)", "value": "0ab26ea3de8d84b3d9e0385d443c80c57a4acccca80d38ac382e241b75fa1ec6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212906, "uuid": "689ff168-2540-43f5-aae8-fb1afd13486b", "comment": "Malware payload (Dridex)", "value": "f1e67a373a73be18855b646e9cc880414632e3bf", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212906, "uuid": "8d713f0c-98d7-4f4d-8e04-a7bb971f13c9", "comment": "Malware payload (Dridex)", "value": "17c1f0996a52d0a0e09b5e4b151b080da4efacb25ae7cf8fbbd676ca6a3e1cd5f4d6b911517b0d755a23ffedb5810f14", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212906, "uuid": "eb5ca654-e6e8-4fdc-bcdb-b015d63f5f19", "value": "T1D3C56B10FFF205C3C09DF739788D3415B2B3AA64811F8A5D824F131E6DA5B912E6E99B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212906, "uuid": "335500b9-afcf-49d8-a10e-7ebdab08e67a", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212906, "uuid": "a0effa7f-ddff-4954-98c1-c563c914ada5", "value": "12288:WVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1N1:LfP7fWsK5z9A+WGAW+V5SB6Ct4bnbN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632212906, "uuid": "df61d365-b32e-443a-a949-64d28f605ec9", "value": 2682880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632212906, "uuid": "619d0532-9f60-4e0c-ae02-4c0bb4418eeb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212906, "uuid": "b21afb2b-5259-4ab5-a69e-fdd6abe6d50b", "value": "0ab26ea3de8d84b3d9e0385d443c80c57a4acccca80d38ac382e241b75fa1ec6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "482076d2-1ab7-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632213503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213503, "uuid": "d2c6df0d-ec2d-48b7-975c-0eeb0d52a46f", "comment": "Malware payload", "value": "0b686ec8cf635909d06d0a6bafefd986", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213503, "uuid": "61078e4d-d595-4b6e-b361-d9db79b5f661", "comment": "Malware payload", "value": "0bfab2580db9bb4b938d0ad6cf3388deee8f907b55b1c2ba1b95a9eb8d97f4d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213503, "uuid": "8e45030d-2a29-4931-8b6e-cb0fcfa4e3bd", "comment": "Malware payload", "value": "83c48b17789ed8750008cccb6f1c9902cdc895bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213503, "uuid": "47a761ef-b25a-414f-ae4a-2eff16978460", "comment": "Malware payload", "value": "25d8d80507630febfbe5cb6605adeb37f1c4199a6da087863a91e3afe9137216623e27d733469a86f76253902033e136", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213503, "uuid": "4bd004b4-d909-4c5f-a360-ad7c7c218343", "value": "T1CB65339DE93C2E3BE24ACC38FE5C7F898464753A26DEB210A65FADE374D96152834440", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213503, "uuid": "d8b875a8-581c-43d5-9922-fa92c8de1bbe", "value": "2cd14f15921469c2e776cf169a885091", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213503, "uuid": "8f77e0c8-dbfe-4def-b776-570aca99e16f", "value": "24576:WEMaXQquDLcYTH5UlR6rEgDZ4RkWVzCJJQuMVlStPT7gg7hFriYi9T9M+UZ:/MQQquDLVr/VqkEG0uMnSlog7GHT9eZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632213503, "uuid": "a97a79d9-ed68-462b-be5f-263e6609b589", "value": 1419872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632213503, "uuid": "a7c4e4fd-8206-427f-94f6-0855c20c61d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213503, "uuid": "c14e7cef-49ae-424b-9bc1-c7f8d540a1c6", "value": "0bfab2580db9bb4b938d0ad6cf3388deee8f907b55b1c2ba1b95a9eb8d97f4d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbde9cf2-1ab6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1632213375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213375, "uuid": "0a96a391-cebc-4f4c-9d92-7767d9162f7d", "comment": "Malware payload (njrat)", "value": "0a7c4d3e00285907574ed93105e7cbd0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213375, "uuid": "5853d070-011d-4add-a259-b79540c0e18f", "comment": "Malware payload (njrat)", "value": "0c5c72f6b371e157babb410027a947c70555a1f9bf4e1900664249f4d51e3290", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213375, "uuid": "a5f1b123-6563-4874-bce1-9163b6eb6c29", "comment": "Malware payload (njrat)", "value": "f5acb2a4339b7c0adc7b952a28a6e25a550ace90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213375, "uuid": "c67eb9d1-8659-4ccc-aedd-eb1e8fd4b3a9", "comment": "Malware payload (njrat)", "value": "f6587d08293f4ee9f96d463988b690cdc1bbc3710c630d8e7b7a2fb0b3232f365ccd2dce5d5e4b81ac0420415562f2a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213375, "uuid": "14509b76-599d-4ffe-878c-dc73b88e03f1", "value": "T116C412067351E331C69B61F6B80212D4A210D629F7D7EBB6E274C2046DEE75CB29FAC1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213375, "uuid": "1459da65-b2da-4f14-afaf-eded74f3255b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213375, "uuid": "4a51c0dd-466b-4c6d-b7bb-3a3bd5e65396", "value": "12288:qdc17+4YPzAr2u/bdo8iY9ELcp/gT3CJLnUf4AbRsu:qde7VYP0r9Ddo8iYq4AbR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632213375, "uuid": "0a78cbe1-79ac-46f7-80f8-1b59b599dc73", "value": 558080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632213375, "uuid": "e314134e-74e6-4e4b-811d-ff3c3fd8dd50", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213375, "uuid": "34998cfe-d33d-4e7e-b69b-7ea308adea06", "value": "0c5c72f6b371e157babb410027a947c70555a1f9bf4e1900664249f4d51e3290", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b022cf0c-1ade-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632230428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632230428, "uuid": "c77d476d-d2d1-4dbe-a9a0-34ced575060b", "comment": "Malware payload (RedLineStealer)", "value": "94c17903ebb08d6e352dccce353d95d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632230428, "uuid": "fe09a260-cea8-43f0-ba4a-b2ebb370e703", "comment": "Malware payload (RedLineStealer)", "value": "0cca2cf75954208aae60a90301ad47085d2631ada3f2c493ff5a8c043e2d7728", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632230428, "uuid": "331d93f7-4012-4186-a8f1-c69d42296e83", "comment": "Malware payload (RedLineStealer)", "value": "062b3bfc9ef358bba2749bde70074ab2e4dda600", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632230428, "uuid": "c64d185e-5a37-40b6-8cb9-145e4a2f7535", "comment": "Malware payload (RedLineStealer)", "value": "7d5797b9e098acaa62b1f68be6eaed022df7bbb10ff5a1bb756fcc39d1aa794d239ad40e4883b9e8c826e43aaeaf6c38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632230428, "uuid": "61880fa5-7852-482e-8680-dd785c4c6f24", "value": "T170C3D817B2C43179F3FBBF3B5463311135EAA2132A1F674872DC6BDC6B22658A876118", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632230428, "uuid": "73a11d73-6f6d-4ddd-bbb9-548e607ac395", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632230428, "uuid": "ef75be59-943f-4824-ad80-33606502faeb", "value": "768:s5zZ5/sQs01BFVaAl+ahpAqv0x636bZqWjO1YrZ9XnOE/Fngj6/EnOXP:s5zk43f+qvNKbZqW6+rXXnRF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632230428, "uuid": "886b1638-d84b-4a7b-bc33-f01a77820f49", "value": 118272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632230428, "uuid": "994a1824-82ea-4429-9c04-99a638211c13", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632230428, "uuid": "5528e309-20b7-4937-a376-35cca5b3d608", "value": "94c17903ebb08d6e352dccce353d95d4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfb624a6-1ac2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632218482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632218482, "uuid": "5960077c-3d16-4946-b4a6-68ddeeba1975", "comment": "Malware payload (RedLineStealer)", "value": "5ca4089c94b943e49179a9d09fe1001e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632218482, "uuid": "853ca10e-b5b7-43ca-a4ae-29e09272bb86", "comment": "Malware payload (RedLineStealer)", "value": "0d27e1904d942e4d52fbfbd2b8ab2753bfbad6f2f38de183bd2afe6d397b2807", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632218482, "uuid": "ac340920-0d42-4270-bfc3-3028a66c1237", "comment": "Malware payload (RedLineStealer)", "value": "abd5ac36ad15d36a2b568f7c17c683bd1ab6e7b1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632218482, "uuid": "5f613b22-aa35-40b0-b68b-a3dd936492bb", "comment": "Malware payload (RedLineStealer)", "value": "2923cc7a867281add4e4c423661ba0bdc305d28f0c6348a205db3d4da8cbbd540fc4e4cc9013c27be4c9ab22b662d267", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632218482, "uuid": "d56f2bc3-62c4-4e3f-a395-0a6a75beb31a", "value": "T1E174AE20AA90C035E7B701F9597997A8A93D7EB15F2390CB22DD2BEE56347E49C30743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632218482, "uuid": "c2f79165-873a-4fd1-a033-2bbbe9bd7ca5", "value": "d0a8c3f24685503ba25bd76f34c13b9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632218482, "uuid": "5413e1f7-e27c-407f-888f-d39c2254f7fa", "value": "6144:h27eZaGyT0GIOurNqSQSL7QBDviLF+vDux1ZWY8Ljw/gsliOst:EC8T0G5urRPL74m5ai1F8L+i/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632218482, "uuid": "c3b41d8e-2dd0-49b2-8ab9-112e73be368e", "value": 352256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632218482, "uuid": "7aa77053-ee7d-40c0-8a99-3e0ddabf26b7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632218482, "uuid": "5793f628-02ab-4886-b670-d5dfd4b4481f", "value": "5ca4089c94b943e49179a9d09fe1001e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b95cf69-1ab6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Chaos)", "timestamp": 1632212999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212999, "uuid": "73f37c07-9afe-4db9-8c7f-bf2d108e7967", "comment": "Malware payload (Chaos)", "value": "5b61e933fb4b526837a23637ff6bef7e", "object_relation": "md5", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212999, "uuid": "193df1c2-d953-4694-91e6-e82ee4459480", "comment": "Malware payload (Chaos)", "value": "0d683d2e4fa69e5a5780ffcec285131df7d3467d0f5483ad7d1e918160817886", "object_relation": "sha256", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212999, "uuid": "579742cb-193d-45c0-bc22-cd2f40087e3d", "comment": "Malware payload (Chaos)", "value": "34056a337b596b2bf2682df0ec1247b0ad14a972", "object_relation": "sha1", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212999, "uuid": "528d7988-9669-4de8-9cb1-ae4f473bb9fa", "comment": "Malware payload (Chaos)", "value": "e1dd131730319b54a1d3869630e0d50ff1df980c506aedf3864ccf146ea0fd9bc50f4eb64d3c4f3e899c3a9c62a0331e", "object_relation": "sha3-384", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212999, "uuid": "7b7e3f4d-4439-4c79-8275-74e6ab0d4933", "value": "T113A57B342DEA602A7173EF7D9AE4759A9A9E77A33703884D10B103CA4723943EED153D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212999, "uuid": "cf29caf7-1655-4a6c-87dc-2920751e1a39", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212999, "uuid": "0acc0e84-f762-4c98-b552-f20d60f25cc0", "value": "24576:sQ9KEiW7BDhcA2lCNdv7m0kHV+BeEo42/ohj0j+x2N6DKiM1uSoFK:cJ46jAV/jlgAU6I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632212999, "uuid": "accc2892-c17c-46bf-b831-7614445d81ee", "value": 2255360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632212999, "uuid": "78324c38-54cd-4f7f-854f-c5fc1fa836a7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212999, "uuid": "6c890761-11f0-4217-ba48-a884e40abdfd", "value": "0d683d2e4fa69e5a5780ffcec285131df7d3467d0f5483ad7d1e918160817886", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "305ccb6c-1b1c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632256842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632256842, "uuid": "d11ef187-8966-40ab-adc7-4f99c273ce8f", "comment": "Malware payload (RaccoonStealer)", "value": "79d48eea158c8afa783a8d47cf7fb010", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632256842, "uuid": "22983392-480c-4ed9-8b6e-c27d62671e69", "comment": "Malware payload (RaccoonStealer)", "value": "0d74d76f50d3f6211c56cd9c07554a91f0dacf0005d2a5de2d5990241a7f2ae4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632256842, "uuid": "f3e79390-867e-485d-8852-6b4aee0bf247", "comment": "Malware payload (RaccoonStealer)", "value": "26767a5179a56e42b9d7330faebf96dd8ce8dfdd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632256842, "uuid": "b3ab04cb-9032-483d-9944-3edb625a5c16", "comment": "Malware payload (RaccoonStealer)", "value": "883fe0e913f2fb80470642e2372bcebed4819e77838c19ca3b48e4d5e336e68b29f8ad00086a4555c534ddd034b03367", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632256842, "uuid": "7a3e638a-ede6-4fc9-8e1c-2b9c499e5985", "value": "T16C14AD113ED0CA71C5A709708C28E6E05776F861F564CE8B7B5AFF7E2E30290466639B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632256842, "uuid": "fd8494bb-7b90-4eb2-b19a-e6dcd6fd6c2a", "value": "b423274974f58a1d1a63a5242c6dcf99", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632256842, "uuid": "143ca299-2d24-45ff-a9c4-b952cbff75cc", "value": "3072:Dfxnf9bfmhMvyEDNL4e5OEGvTMG/UautIxAwjtqAWb:PbfHDSxVvQG/lKBwjt4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632256842, "uuid": "d69e64e9-ea92-46aa-ae40-f91e4f7829b0", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632256842, "uuid": "7ffae2e1-24b2-4cfa-a316-b65269938941", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632256842, "uuid": "e73bcc76-cb0a-4c5f-8ebb-6e4126022eec", "value": "79d48eea158c8afa783a8d47cf7fb010.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "044957bf-1aa3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632204799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632204799, "uuid": "cf5ff64f-7c07-4bc0-a2b0-8a3fb684d677", "comment": "Malware payload (SnakeKeylogger)", "value": "2bbe4e114f0966f35d9151281c255c12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632204799, "uuid": "d00e326d-c725-429a-b1a0-a713a146d18d", "comment": "Malware payload (SnakeKeylogger)", "value": "0e281f621fe679de55b294c0f7a4df4a60fbe0074a364a2a1efa2235940484c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632204799, "uuid": "307c30da-55d4-41ad-baf1-f75f4069d14a", "comment": "Malware payload (SnakeKeylogger)", "value": "014d5f1a25de6a83658665c73b252366353b0498", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632204799, "uuid": "8ab8577d-9839-4bb2-ab83-8cfce4736946", "comment": "Malware payload (SnakeKeylogger)", "value": "e8d8ae3c26568848a5621f2fef40399b7e982457a257f6e64139d04b4b53e4678f60a6b57b39f9d66c4d8a1cddcd9f43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632204799, "uuid": "1ed210c6-1f0b-459a-8b78-441ce01a0f79", "value": "T111440247B5E2C9E3E05993B18EB783B9F52BBD4D01610A8F47C5BD673EB01C2421E692", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632204799, "uuid": "d3e9003e-a438-45cc-abce-6dffe26a7bc4", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632204799, "uuid": "d005fc96-9c33-410f-82fd-a48db35bf4e1", "value": "6144:Z8LxBnorXWRSXCXpw/Vf1GbZ9fOmX5GO5DBQ3K:7bWkXCXpqVUbZ9fZX5vta3K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632204799, "uuid": "8c654e47-da15-49b7-b8de-524cf2f69942", "value": 268416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632204799, "uuid": "cfe141c5-f631-4468-9e0b-08acf8d00ae1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632204799, "uuid": "1802d7dc-6016-4b97-a418-e0a0b154089d", "value": "Orden-CVE6535 _TVOP-MIO, pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aabae00-1b1f-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632258202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632258202, "uuid": "45e689ec-c263-49ae-9c2c-f396e0404a35", "comment": "Malware payload", "value": "cff6445670f4e1072714bf605a89986b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632258202, "uuid": "079a3ea4-ce3a-4145-9052-ce63a309de7e", "comment": "Malware payload", "value": "0f2d5147aae4fd4e1a889833951dc44bdbc7fa38d6abe32b38993c8969fa7ff4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632258202, "uuid": "edccf512-926a-4ce4-8a1f-a4acab07ee1d", "comment": "Malware payload", "value": "a9e3131f58f326f79fcdb95c7e7f22a5f89bd4ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632258202, "uuid": "976ed9be-bfcc-493f-a887-0836d683e3d0", "comment": "Malware payload", "value": "1e2fac98a3bdbba9f4eeda38c7ad5da3a3de77297ac0dddafc4cab7bf63a6c865098d8969263e04517874407d5d8599d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632258202, "uuid": "1f111446-9a59-4108-8ef7-e0ee38ab1e49", "value": "T14F22D609B3D49720E4BA47765C73531047B9FA0BCD27CB4E1ECE614F6D27A009D56AB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632258202, "uuid": "ae1e66da-4692-40d5-99f5-d962f8793ec2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632258202, "uuid": "ece06ec8-b777-4828-b07c-770c68fc8c94", "value": "192:A8QHHGfrRRtHgOs3+2qJvMvzk2tBdHr4CtPLIlThjSug/:xSErRRBgh3+2qJozk2FUCtkl1jc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632258202, "uuid": "447bd20d-607d-4175-8365-1236d085b5d4", "value": 10240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632258202, "uuid": "660c1505-51be-4297-ac50-24ec3f3d0e43", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632258202, "uuid": "3ee1eb81-1927-4d3d-864c-a703b8913f2d", "value": "test.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "497eaf2c-1ab6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632213076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213076, "uuid": "65f1db09-9900-48d7-95b8-10e0280057ce", "comment": "Malware payload (Dridex)", "value": "a01b01412e4d899d778ad87c5ed1d75d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213076, "uuid": "58b8fdc5-aec3-4ae3-b651-c67502a4aff9", "comment": "Malware payload (Dridex)", "value": "0f7f82bf2aa9aea81c40c37a0327004bcd2cbbbefb3baa1e293273b7afdb0601", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213076, "uuid": "91ad331d-3e0b-4e28-880b-1e24e01ecefc", "comment": "Malware payload (Dridex)", "value": "f680dfd7f2b8436e54b6ce203e76367686505375", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213076, "uuid": "3184e706-d230-4552-abb6-0419263c8a6c", "comment": "Malware payload (Dridex)", "value": "cfa412c37a83fb6ece427671c8a73881a14d7b12c2941032c0701fe9a10dc1c43e93b4073550d382c0f69180e2d350f8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213076, "uuid": "7685fb8d-4839-499b-a1c4-eaeb3353df11", "value": "T176A5E120EE69E1E6C6B99F3E940835231BB93D75110D609CC391604F9EF82546E3F9AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213076, "uuid": "3755c0c5-d8a8-43f4-a236-e353d63ce0e9", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213076, "uuid": "471c741c-844a-4da6-a2b0-c1671d48abf4", "value": "12288:8VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:JfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632213076, "uuid": "91f57bb1-5c8d-42c1-b6eb-c84547c616f9", "value": 2105344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632213076, "uuid": "16b34275-d161-43f0-9881-6ad5d7775f19", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213076, "uuid": "e892f3bd-662e-4db1-acdb-d3b613301d3d", "value": "0f7f82bf2aa9aea81c40c37a0327004bcd2cbbbefb3baa1e293273b7afdb0601", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "335d47af-1ab7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (MassLogger)", "timestamp": 1632213468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213468, "uuid": "67605caf-a255-4750-92ac-95e4cce2f582", "comment": "Malware payload (MassLogger)", "value": "fec1a9eb0e5ca4868f9dc607f5fb1a72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213468, "uuid": "bf946550-544b-489e-a606-fb13667a6bbd", "comment": "Malware payload (MassLogger)", "value": "102f91266026da7eb656fe30e15fb7eadda1335013bc21ab3e0a986ea1ff7727", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213468, "uuid": "a7f41e73-433f-4b9c-a1e2-f8016a8cc8ea", "comment": "Malware payload (MassLogger)", "value": "aca70b49fbfdc3543c8f5b51df0a03780834f686", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213468, "uuid": "5a3c8cfa-1f2e-4cad-acb6-bf36f8ff09e4", "comment": "Malware payload (MassLogger)", "value": "87ac498012b021ff5ccdf4247dd32867c6928d5d3a2bfbbc9f05b5149986bdbd8f45e95f24ed26704447919080bb335f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213468, "uuid": "c68f88df-3ffa-44dd-a7ee-60edf8c29432", "value": "T130252A14F7E855A5F06EBF30747094054A39BE43697DD74A2BA6A1890F7B3808CB1FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213468, "uuid": "3917fbc1-1362-422f-a261-dbfa2ec108d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213468, "uuid": "77e861fd-d59e-4387-9dbb-7ac83bdf2e7a", "value": "24576:9nkdueXjq0OQKc2YSEegpQRDLusJLK1lkzoL9:JkdueXjq0OQKc2YSEegpshk1lk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632213468, "uuid": "dc15d55a-25dc-43af-b2c3-e7de462aab70", "value": 1006080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632213468, "uuid": "f9a9b0d3-da66-4e94-b0b0-7933a8452b8b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213468, "uuid": "e8acaaca-6b35-4bcc-9179-ce60be042968", "value": "102f91266026da7eb656fe30e15fb7eadda1335013bc21ab3e0a986ea1ff7727", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02af5ef3-1aa3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632204796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632204796, "uuid": "bbeddd41-59c1-435a-b687-433b0185559c", "comment": "Malware payload (SnakeKeylogger)", "value": "5832118b5a98bb382340cc9a00a2c4f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632204796, "uuid": "fe55879d-2230-4b61-b0fb-910d9f0246d7", "comment": "Malware payload (SnakeKeylogger)", "value": "104ff8c9a13125d6652d1dd1d9158b1612cd92bf6bf1bd4e4b73f112ece7a159", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632204796, "uuid": "04e0fda6-8819-4d02-907f-d1cb0b14cd1d", "comment": "Malware payload (SnakeKeylogger)", "value": "e99a74fd27553bfb4e84095af0490c836866bd4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632204796, "uuid": "e1286ed9-d2c0-40fe-bd24-1349739e8340", "comment": "Malware payload (SnakeKeylogger)", "value": "463e11cd5e40d0782c5293dafc4a24f844913b9e0d4a97855ede4995b945c6be46e2bae90eaa9f5195f37bcad8eaacba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632204796, "uuid": "8dce692e-f5d2-422e-bff0-8b9f6bad40be", "value": "T1F8B42860156E7D75C0B46B3A477357E51BEEDC402A7ACF896B22F27A003C6D77E82206", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632204796, "uuid": "4f5a26bf-212e-4748-9c9b-ff7200812aed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632204796, "uuid": "3e103afc-9aff-44da-b9ed-ae2cf3372a3c", "value": "6144:4mbWtktu1elwyu9Zk32Ineg6G4d2cl7TTznyouSmSX7:4Q8UlPu9Zk3n6GM2cl7X6k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632204796, "uuid": "92fb6696-b288-4a16-9aec-bf319a841573", "value": 519168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632204796, "uuid": "a00c679d-26b7-4744-8d63-13c00e3b44fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632204796, "uuid": "0814f7a4-a8d3-4582-85f6-f0fdb4e56454", "value": "5832118b5a98bb382340cc9a00a2c4f9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b94fe9f2-1aa2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632204673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632204673, "uuid": "0e88c070-3c00-4cc1-bde6-f5a957a94d79", "comment": "Malware payload (AgentTesla)", "value": "addb4d56629cc7eb051f6098deff73c9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632204673, "uuid": "a7ec6419-6997-4f77-8f29-d622b7982a7d", "comment": "Malware payload (AgentTesla)", "value": "107c8736f92e187341179f7e0339495f3236e823da97c9f3e500adfc0cbb8e45", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632204673, "uuid": "4f876ca8-d2ae-4faf-88cf-fbd8dd7a9260", "comment": "Malware payload (AgentTesla)", "value": "93f336fc6d28d8d8c84dd82ec6a4479504950cf3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632204673, "uuid": "bb711359-1c1d-42b7-aa0a-ac60b0e9e92f", "comment": "Malware payload (AgentTesla)", "value": "e0018eb35ddc9325d6fc078d24d4a95fe2df1b5b2563bc77c78712c4264613df076c604e410ea6a06d26b65d01b132bf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632204673, "uuid": "a083f88a-fc1c-4a7b-8492-80c3f3c7a07a", "value": "T19AD43324CAE110B6804F366212F86ECFEB5BC274A1FD86C368A9D1D165FC834CDB5266", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632204673, "uuid": "04db325d-40b4-45a6-a0e7-9c342a4f89f2", "value": "12288:+TGgbdP2Ul13htS1A9LSh4Q7TsXPrdkPoPpbJE2VcujwDpniepGG/9T3GZ:si23hEi9LSaQUXPaAhG4c8Apni3i9E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632204673, "uuid": "c3badb15-9a4f-4918-a5a6-61d926d39c3e", "value": 652491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632204673, "uuid": "9a30cbb8-9446-478d-859c-c6886171c3fd", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632204673, "uuid": "1bc51154-3a5c-41ae-be00-f5410892bdda", "value": "FACTURA.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ce17d34-1ab6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632213081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213081, "uuid": "98228ef5-1959-4cbb-9ebc-0a8693063a87", "comment": "Malware payload (Dridex)", "value": "1ba3571561cd3cde58a90f5ca884b3de", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213081, "uuid": "04598ed5-7363-4f9d-adeb-d9ea1e2b6d64", "comment": "Malware payload (Dridex)", "value": "1187dbfabebe6bc98e220acd6d949d527adbfafdaa7757d5c1771ca5391f1f92", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213081, "uuid": "81996145-0285-4e23-9b85-f56ea084b604", "comment": "Malware payload (Dridex)", "value": "21fc45689d86ae1af215ef016cf9b084dc810ec8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213081, "uuid": "93c049ce-cf74-4d4d-ac73-a28b41d04889", "comment": "Malware payload (Dridex)", "value": "7213826f41288a594f8cd6f94ea2dd25735c1e4ef7038803bfe868a611feed5469f8bbd400d576600d193a7cfad8b9df", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213081, "uuid": "5a7197ab-f247-4e6e-bb41-f36fbc3dccec", "value": "T1D4A5D020EE69E1E6C6B89F3ED408352727F93D75110D608CC392604F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213081, "uuid": "2d0b3816-56de-4bb0-b2d5-7a20f974ddf4", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213081, "uuid": "cb2afef3-22f2-4d56-a6c2-d0797a825f0c", "value": "12288:VVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:MfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632213081, "uuid": "3d0f252c-77ee-4d97-addf-eb157f3cf25d", "value": 2101248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632213081, "uuid": "e3c82cf9-f9f3-4950-9870-4316944b974b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213081, "uuid": "b6b3577c-79d1-4d57-a957-8261e151ed0e", "value": "1187dbfabebe6bc98e220acd6d949d527adbfafdaa7757d5c1771ca5391f1f92", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e4fbadd-1ab6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632213111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213111, "uuid": "0c319ec3-d896-4ef3-a1eb-03b964d2e2fa", "comment": "Malware payload (Dridex)", "value": "9bb781c42c7e9ca7fbc10268f468e9c4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213111, "uuid": "da6c6e51-bb1d-4d9c-bcdd-e2c6ea2bc5ea", "comment": "Malware payload (Dridex)", "value": "11de06eaca4fcea7ad3e1d29adccb0e97d12d1d8109d98b1648834c53bd149ba", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213111, "uuid": "d52e064a-a867-440e-a9ce-1e63bb98d7a0", "comment": "Malware payload (Dridex)", "value": "eacb786293c2cad9827c01e0bd0591aab2be2544", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213111, "uuid": "3fddf3fc-c318-44a8-bc35-b666e957bed8", "comment": "Malware payload (Dridex)", "value": "b45ae9566720ff8ed2fbe41758b9106ea261211b4ff4952850e4e0cd1b1fc8b5b43c25a00936b27a6349e5b33ef76052", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213111, "uuid": "8e405c88-7fb4-424c-bc6a-8c77b6146ffe", "value": "T1C795D020EE69E1F6C6B89F3ED408352717B93D75110D608CC392604F9EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213111, "uuid": "d91a86d3-d4dd-4ac4-9c41-aa69171e24c1", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213111, "uuid": "b5fcba79-1648-4d51-a3cc-426050da0022", "value": "12288:IVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:dfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632213111, "uuid": "ca19cf39-b8a3-40f7-a698-37af4306a7a3", "value": 1961984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632213111, "uuid": "e54c85be-6c20-4c13-bd7a-04eba15e2fe1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213111, "uuid": "7f6067ff-4e23-4304-b177-9eecda409f7f", "value": "11de06eaca4fcea7ad3e1d29adccb0e97d12d1d8109d98b1648834c53bd149ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "239b0308-1ac5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632219454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632219454, "uuid": "a05d620a-b17b-469a-a1cf-70c21e3b61ae", "comment": "Malware payload (AgentTesla)", "value": "e81a2d95711e1bd0565d21db35b4b03c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632219454, "uuid": "50167460-a5e4-4c6f-bef5-f645adb0dfce", "comment": "Malware payload (AgentTesla)", "value": "1332ea19c455b9cf6ab13f21079cd04082c538b83a5fbc9ba09d69e6b3e72db3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632219454, "uuid": "a468db17-5701-4826-af90-85fb2379d76f", "comment": "Malware payload (AgentTesla)", "value": "42e6daab7d05e0b4bdd64615b5f9bc82d40d2904", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632219454, "uuid": "23f65b78-75e5-4a2b-973c-20442f5daec4", "comment": "Malware payload (AgentTesla)", "value": "c65204047c6d6e2b7da2ccc154b218da570af77a8b61def3ce1bcfd57e9994e4b727da6dc5d9cc4d94c035db59fbc7b1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632219454, "uuid": "a713ef64-9eae-4ebc-8489-6435fd5baba3", "value": "T1F2D41242B0AE8690D79A3B7120A583513BB7FDB65833E54E26CD714D0B3B3825E34B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632219454, "uuid": "6b6b92c7-4e4c-467d-9208-f9a16e45942a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632219454, "uuid": "e478ffd3-4040-47e0-a340-155dcd6a8747", "value": "12288:JBIbw8eGGmtiK5obEbk1EPde3kg72Un2PKkI2JCHB:Qbw8eGG+FoChAfn2PKRH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632219454, "uuid": "63c39173-1155-4c75-83d0-2d8a2fb81fcf", "value": 644608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632219454, "uuid": "49736d3a-c6ca-4ee9-a01f-7276bcbac244", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632219454, "uuid": "ce796b29-feef-432a-9b7b-52ace791064c", "value": "SecuriteInfo.com.Scr.Malcodegdn33.27584.7523", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8614a0e-1ad5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632226630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632226630, "uuid": "7e65ff64-c884-4dce-893b-a45b255ed31f", "comment": "Malware payload (AgentTesla)", "value": "73cf8155bb9656f85a18b495eb11364a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632226630, "uuid": "94ef1ebc-f849-478a-aef6-8ab5f3fc80ad", "comment": "Malware payload (AgentTesla)", "value": "1341c033ee30713baf6b5e3c07715f995e4671fac87440ab52d0ff9ea33e1a3b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632226630, "uuid": "598223bd-5e59-49b2-8e74-43d3191ff271", "comment": "Malware payload (AgentTesla)", "value": "ad6380e3ae8fdb7a2139b9180fba77993306964d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632226630, "uuid": "c20d850b-9bda-40d7-bf84-e85ff8349b99", "comment": "Malware payload (AgentTesla)", "value": "fb7a7492c00562856fc5f30ed2ca5caa0ededcd0d3de7b9fc0cf2de5a0651a7eab4b73bd1cdc7cd17efcc05f4a2f13e2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632226630, "uuid": "1502347c-8cf6-4376-8bb4-0f49f43483e2", "value": "T168158D394D2686F787EEC67CD04C4FCEDAA6A4837B918F1AC496D7C2429770BE48845C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632226630, "uuid": "a1625599-33bb-40ea-a971-5d454da8b2e7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632226630, "uuid": "97d56cbe-e23a-4473-bc8e-a6b4ec0966e1", "value": "12288:mxkmOdRPyYb3DwhA91ynBwkAAOHmgskilPaFWaR1F:2CxXynZHgHgY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632226630, "uuid": "eeef2b0b-4c13-408c-b083-3f927bd13c8b", "value": 909824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632226630, "uuid": "bf8c790e-bb02-4a18-a545-fefb6f651456", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632226630, "uuid": "fe27ff23-9585-4ee0-a9e2-62643ad53c5e", "value": "Purchase order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2302cdf8-1ad9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632228043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632228043, "uuid": "42898bc0-faf9-4403-a3af-0ad6d67d98c4", "comment": "Malware payload (Formbook)", "value": "c80faa74ccc7029f9b02df7a2e4abce8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632228043, "uuid": "7d056c3f-ff24-404a-a236-ff943fb517fb", "comment": "Malware payload (Formbook)", "value": "13c385c3a7e1297c506764e1b956a5aa568590389356140c92e2a2cb953bffe5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632228043, "uuid": "b5094f04-9c97-439d-b17f-7193861b09ec", "comment": "Malware payload (Formbook)", "value": "7165ba4655b4960a374aab979a5be67c7a395cdb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632228043, "uuid": "80a434ed-f372-4801-9ec7-651e45a4c30e", "comment": "Malware payload (Formbook)", "value": "f1dcb7cb7f62f9e3085dcd2bb2984d45eaecd2e7f62ac4ede6e4c265f0a8bd4ce09a24ad3d4d66bde070606ff4db8bcd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632228043, "uuid": "3a608e54-66b3-452a-ad1a-b212b2e5b108", "value": "T160C4019236AE8618C7DA373121A593407B37BD756973E64E2ADDB08E4B372414E30F36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632228043, "uuid": "7f1d58e6-b6f3-46e2-b311-1a08b027abaa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632228043, "uuid": "18994b9f-7058-409f-bd3a-17fd73f43416", "value": "12288:WQIbw8eGGmtiK5oTOZaG2OKhZSlH5Mo/kuMK78SmBIh:+bw8eGG+FoTmxKrSTcd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632228043, "uuid": "9090be68-c26f-4494-b2b8-b4d26affbfad", "value": 590336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632228043, "uuid": "eabdbf37-4cd0-4a2a-8782-589e5eb84043", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632228043, "uuid": "39baab75-c3df-4166-8bec-eb8194afac4f", "value": "Payment Proof pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e2e8823-1ab5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1632212735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212735, "uuid": "8441d747-eed2-4c8c-8b94-37b01ce7ddb2", "comment": "Malware payload (AsyncRAT)", "value": "f11c01cf16a698c1b9ed67d298e10faf", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212735, "uuid": "ea3e8691-208e-4a5f-8b14-a513ab346e9e", "comment": "Malware payload (AsyncRAT)", "value": "14ed1febd3d4699a4c44ab5ea4f00ee9428457b61d519b375c0cdcda8a38c951", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212735, "uuid": "99661e2d-58de-4b9d-ad94-a46ce1c2ddf9", "comment": "Malware payload (AsyncRAT)", "value": "3318f0e8406827a459ed38648f8446bf311dbeae", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212735, "uuid": "a4b07b5a-0d87-4360-b973-5a362276235f", "comment": "Malware payload (AsyncRAT)", "value": "9c3eaecfa650b6854c77fbd037bb5685e73b12998de717269035cfe00e00c42e0cd76ac35df51bb97cf688f9debfb9ab", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212735, "uuid": "c520eaee-b463-4b77-9b05-011bbc2012e6", "value": "T1BA46232353764046E0E5CC3E45373EE435FA13774792E8B8A5AA6AC226769D6F313E03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212735, "uuid": "b8031430-f71c-4070-8ffd-53901cc9ae2b", "value": "172750858dcc0719eed08c952858023c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212735, "uuid": "095b8148-3052-45f9-8957-5b4f86908dd8", "value": "98304:ePUgQFmj1OSkPX36/NuZdq3GPmx8UDYWtJUMSWL8j8muZAblgCKnoBF0AbU83/:ecSj1D+E4Zdq3lx8Y/eMSWL8jeGyfnxA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632212735, "uuid": "beac8df0-5f0a-4d24-bafe-6568b71cbccf", "value": 5477888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632212735, "uuid": "4b1fe22a-6e52-4591-a49f-2364b9f8846a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212735, "uuid": "5e57905a-59ad-4f99-a60f-cdf937168f1c", "value": "14ed1febd3d4699a4c44ab5ea4f00ee9428457b61d519b375c0cdcda8a38c951", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f2d9f01-1ab7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632213488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213488, "uuid": "49ba1890-c1f3-4f1c-a330-7862db744d70", "comment": "Malware payload (Dridex)", "value": "cb8fb5f1f940c0d7362a0b47365bbbba", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213488, "uuid": "4b43c19e-2d31-4f10-8687-3ad17d27231f", "comment": "Malware payload (Dridex)", "value": "16204d7e51d5ef70f0b829d5b05161a18db2f4fdb31c81862be3fc1ea2045ce5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213488, "uuid": "3372e3d8-b3cf-4d19-ac0a-ef3ffc2f8071", "comment": "Malware payload (Dridex)", "value": "f3757337c93ab8fc154d5ae385168376416f0eae", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213488, "uuid": "37d504d3-21c5-4331-a4eb-8a8957fe42fa", "comment": "Malware payload (Dridex)", "value": "1e96a3176e272f676b7370e36dc2a01ba56b8f0dd4a17a996a20fd9f4dc63ede2a44fcbc3e733554dbfaf0b10d23705b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213488, "uuid": "f9fa25c2-a2cc-4826-bc29-7a3b2f404415", "value": "T13E45E120EE69E1E6C6B99F3E9408352317B93D75110D609CC395608F9EF82506E3F9AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213488, "uuid": "d10821a3-0003-4de0-9ec1-a7cd53d3110e", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213488, "uuid": "bf7f592d-ad23-4e58-b460-fe16c8897088", "value": "12288:9VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:kfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632213488, "uuid": "6504c54d-b3af-4277-b008-a24ab324ea17", "value": 1236992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632213488, "uuid": "eba54a2a-92ac-4c8a-bfd5-b0df42286575", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213488, "uuid": "17e651bc-7ffd-4588-a03f-a002c57bbb92", "value": "16204d7e51d5ef70f0b829d5b05161a18db2f4fdb31c81862be3fc1ea2045ce5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aa7a5a5-1ab7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632213507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213507, "uuid": "8c20ef6b-6399-4174-a73c-5273f2a57d44", "comment": "Malware payload (Dridex)", "value": "c7a19ddbd10764d29c40a74c191373d9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213507, "uuid": "da92f0e8-bae2-4054-8ea1-73a487a7548f", "comment": "Malware payload (Dridex)", "value": "165f856f549ba87e7e2e06489f6dc5f82d42c9bf1ecb6693ad7abe4ba50d02ba", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213507, "uuid": "f7e86844-9189-4cc9-89b2-aef395b077c8", "comment": "Malware payload (Dridex)", "value": "a6b09485b6fb8d64028bae045c02a1c94979f950", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213507, "uuid": "96b7c0af-bd9f-425e-8f8f-b8853ac5ca3a", "comment": "Malware payload (Dridex)", "value": "421bd74b7c07a0a867382044629e02893e4757833222428a23e1563b63dedde7e3b622dff574d636b9d53a8e9e0ec9c9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213507, "uuid": "94ed45a4-39f0-4c05-b79a-e4efd0be31a0", "value": "T11065E020EE69E1E6C6B89F3E9408352727F93D75110D608CC392704F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213507, "uuid": "36645e64-ac47-448f-af76-b62a0862a798", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213507, "uuid": "74803a52-7ae8-474e-b1ba-a2f9ea9dda87", "value": "12288:VVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:MfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632213507, "uuid": "726a7b54-c974-47c8-9b71-e094d73d4d74", "value": 1478656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632213507, "uuid": "e21a9e08-5cd4-4f4a-9c29-060508561e4f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213507, "uuid": "63431400-0ba1-429f-8182-49087ba2075f", "value": "165f856f549ba87e7e2e06489f6dc5f82d42c9bf1ecb6693ad7abe4ba50d02ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac9ec7be-1b27-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1632261775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632261775, "uuid": "8dacc670-2acd-4670-96b1-d881e4ab4aa7", "comment": "Malware payload (ArkeiStealer)", "value": "82fa1c43ec3890c5d6df32c3fbcab79c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632261775, "uuid": "c447d265-daa4-486b-82a4-73bd9326266d", "comment": "Malware payload (ArkeiStealer)", "value": "1665ab511c4742571deef2a68c305560fcd06ae2c7f0f24db1fb04eaba8c9cda", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632261775, "uuid": "5f80f702-535f-4a95-a0ba-7f8ca548d0f9", "comment": "Malware payload (ArkeiStealer)", "value": "ea0ee35319d8679008eedc68fd9efd376fba61eb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632261775, "uuid": "d8398643-185d-4d97-aeed-9dec86024006", "comment": "Malware payload (ArkeiStealer)", "value": "1163919bc0afbca7f74013b21fa9cba9b13a0b00b04f8fe3e697dcf9c849ddbf16431effebc8ec37d3f6ab759d1e352c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632261775, "uuid": "189750ea-7b4f-4eeb-921a-647daccc2b74", "value": "T169E40120FE61C7B1C46740708854D2E4663BF850FA64EE877A46FB3EAE306A05B65377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632261775, "uuid": "fb8a2b2c-f69a-460f-9363-7bf8759770be", "value": "b423274974f58a1d1a63a5242c6dcf99", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632261775, "uuid": "bccfe78d-554a-4c74-8c1e-760334792f70", "value": "12288:+DKuGd3Ef2tydHkYeZltp65C7EYPBYkhdl4q+vX88rOqxlrBay:+GuGifJdH8ZlCqEYPmUbQX88aClrp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632261775, "uuid": "85ba0f64-cc4e-441d-a6d9-60c792992f8b", "value": 676864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632261775, "uuid": "f4aa1bce-541d-40ee-ad97-e3884f2ba0d5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632261775, "uuid": "3367cfde-8100-427c-9e97-5c33ad4bfe8d", "value": "82fa1c43ec3890c5d6df32c3fbcab79c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "123ce351-1ab7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Stop)", "timestamp": 1632213412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213412, "uuid": "0e51a38d-ea64-4e5a-b181-20320631ed1a", "comment": "Malware payload (Stop)", "value": "50f2fae393acf9c0d7f6b0c6985cb9df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213412, "uuid": "8df4c263-da60-4213-8405-5bc9af5ddc3c", "comment": "Malware payload (Stop)", "value": "16ab0466f24ceac741c81e152831d103d97087fe06ad52cdf40c0af437feaf07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213412, "uuid": "6bbfd9f2-fda8-4184-8884-2485dc6aead6", "comment": "Malware payload (Stop)", "value": "3d12ffcfebfbce964d1d303c76f3fe23bc79ef40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213412, "uuid": "14cc5db4-5553-4b5a-ae95-62f2c89f876b", "comment": "Malware payload (Stop)", "value": "3a918626de7eba274d1126078d83dc6e97a355b457e071962be4a751ca739fade388333588a8e2e85cdd619ced64cfde", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213412, "uuid": "56eb3c66-0247-40a9-a1f3-b9251b9b2735", "value": "T1FDF40220AB90C031E5FB12F914B663BDB82D7A71972461CB63D652EE6634AF8DC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213412, "uuid": "a7be0592-b536-4d49-a7eb-086ae4239b18", "value": "42558e76cb0191e50d5255e5f863e8b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213412, "uuid": "f08ca5f4-0866-4ce2-a939-cbb4e2e1cad5", "value": "12288:fZDaF7zfskfN3vGBXX2c7Vtl5UyhA1STUbRBE9nET4/fVYl8rmhQXiDNwCR42ppO:fxaFDvC2cBXR40Y8mhXDCD2ppK2i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632213412, "uuid": "60745c0c-7bec-4190-8d7d-9f809fd6e473", "value": 775680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632213412, "uuid": "f7543a3d-7c7b-4ed6-af1d-c65503766b78", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213412, "uuid": "73a8ad99-298d-4be8-a8fa-f30edd036413", "value": "16ab0466f24ceac741c81e152831d103d97087fe06ad52cdf40c0af437feaf07", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa36dfea-1ab1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632211225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632211225, "uuid": "d295fdb6-60ed-4542-b08e-add369a8c42b", "comment": "Malware payload (Formbook)", "value": "57d15b392c41d1fef88631aa16d1717f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632211225, "uuid": "5d6825e2-294e-47a6-99bc-29b4b1097d5f", "comment": "Malware payload (Formbook)", "value": "16b2ff1b7878c49d974b08f7a91669a472c4bfacbfbf486209c6cefe2c117302", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632211225, "uuid": "65d81028-0c4f-479e-80d3-d4341eb901ba", "comment": "Malware payload (Formbook)", "value": "19edf447fb1f102d85f22df4bdc13f8b5a3504bc", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632211225, "uuid": "5d553117-0f5f-4bbc-b81c-a869e28ba02a", "comment": "Malware payload (Formbook)", "value": "69067318ef7bb446159f4da6d153d05ac3377ce53b074bb3bb16009a268f12ee2beeb567f3359dede955bace62fd92bb", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632211225, "uuid": "d6e44f95-a538-4c83-9c71-642c7444fbc7", "value": "T1BBD4F1023EEE2587DC27EE727D5D1257AEF8DD0DAAE44561E45F77020131EB1AA20AF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632211225, "uuid": "4095b6ca-f8f1-4cb5-a12e-f5e3ec4b084c", "value": "12288:4jbIbISYzD0seIX01D/N8BsUmPjvmq742iBsLFruPKYeU9aM:4jbUvXUG6Crmq7QBsLmeUt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632211225, "uuid": "43b692d2-076d-4fa3-bb4b-7e24dffd550b", "value": 602056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632211225, "uuid": "1f48a570-0278-48f5-8429-76668851fdb4", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632211225, "uuid": "1c2fb3af-48ee-4e1f-a965-8b1427d35a33", "value": "SALES CONTRACT 914 VIPA ORDER 213581.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "591a4aac-1ab6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632213102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213102, "uuid": "89aee0a7-b2af-4550-be23-66f8c14d2dfb", "comment": "Malware payload (Dridex)", "value": "63abbe230b9b590a12f122617b1200d4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213102, "uuid": "e5d56f90-7c9f-4d3e-9348-cafdd04c4681", "comment": "Malware payload (Dridex)", "value": "16d46a8fdc4b3bba7d8a1ec65570bc24d9a735696207f4bae7c12a3ee3b2c76e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213102, "uuid": "43068f85-95c5-4927-b021-447c5a5fbcd6", "comment": "Malware payload (Dridex)", "value": "40139481b2064cd6f21ccdb1500d902df2ee7294", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213102, "uuid": "2e086f98-e762-4733-a412-6d276585b4bb", "comment": "Malware payload (Dridex)", "value": "a9bba9a8d2d4e8442ed37ddafbad6399155dc96d225adbc9327bac90bc07b0915cf7095ac576c58680cf98207b4358b2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213102, "uuid": "d63fa897-8858-4a51-b05e-8982d7502f96", "value": "T17B958C10FFB645D3C09DF73D788D3416B2B36A60811F861D824F231E5CA5B912EAE99B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213102, "uuid": "3442acf0-bbdc-43ab-9fb7-55e9f76d57de", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213102, "uuid": "a66e6d61-ef4c-4ae4-a3cb-3d5344324f19", "value": "12288:9VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1p:kfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632213102, "uuid": "ef5f450e-ee6b-4028-a71b-68fc22ec0cfd", "value": 2048000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632213102, "uuid": "8e494028-7308-436e-8384-f1fc0f9a6b27", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213102, "uuid": "7b439cc8-f371-40c1-ac3e-28dcaa7db3a9", "value": "16d46a8fdc4b3bba7d8a1ec65570bc24d9a735696207f4bae7c12a3ee3b2c76e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6117ac1-1ae0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632231323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231323, "uuid": "1e678930-8c61-4988-9ae3-5d831e100a95", "comment": "Malware payload (RedLineStealer)", "value": "14cf30e247db8388717b8a1eea2ccd8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231323, "uuid": "e9aba8f6-cc75-498c-90d9-cb47d5849910", "comment": "Malware payload (RedLineStealer)", "value": "176acbd438f1dbf033098a230dc2b5066b38d53a2018a4da03c6cc2bfb8ade99", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231323, "uuid": "e3a4f0b5-dab3-48c9-ab7f-de77ba0b1bae", "comment": "Malware payload (RedLineStealer)", "value": "c54fcfc8470b124096cbb3e1333f7d2866a9b8d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231323, "uuid": "82b41be3-a36d-483a-9fda-46378280ae0a", "comment": "Malware payload (RedLineStealer)", "value": "3b31303009431db35e3c3becf6a399f08873442bd3aee64c396fe6014aa2cf4a40cb2cc1e06d740c6bd7c622d2c41977", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231323, "uuid": "8d07a6d2-1262-49e0-bae8-5b40a867e224", "value": "T16064E01136A0CF71CE9324318B21D7E05E6ABC202831A75B76963B7FEF217E1767520A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231323, "uuid": "831d99eb-a155-4bc1-a9df-602cea9bb599", "value": "671b36eaed947d2e663f25178077764c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231323, "uuid": "b59f9de3-8365-4fe8-ac99-2b63cf4d2a82", "value": "6144:Of/tsiEFdbWb6G9sxRustYOuxATKwvEBwjtw:E/miAMb1sLusaHA1vEBai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632231323, "uuid": "f16d8e60-0d46-4be5-9bc2-8f354c53300d", "value": 327680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632231323, "uuid": "209ddfa7-01c6-42e3-bb89-9373ae04c5af", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231323, "uuid": "1aa46399-7fc6-4df1-ac5a-f7c7e800a0bc", "value": "14cf30e247db8388717b8a1eea2ccd8d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bef55e7c-1ae0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632231312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231312, "uuid": "1008486c-94d5-4638-bb5b-28a99e57b7ab", "comment": "Malware payload (Formbook)", "value": "9d38faec3253e9ce395c8970d03d8180", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231312, "uuid": "0df58951-d74d-4d7b-98ae-789d7cb336a5", "comment": "Malware payload (Formbook)", "value": "1771bccdd4c4fdc7d50d97ac10e5b1e0f980a4ff31233c59e9cfa17e9cd36a24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231312, "uuid": "fc35175a-6aaa-4863-a092-c74019eff3c5", "comment": "Malware payload (Formbook)", "value": "53128b83b922c39ed32065c9d8baae2c13059719", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231312, "uuid": "b328809c-0037-4dc4-8a07-83d757c125d6", "comment": "Malware payload (Formbook)", "value": "735378967cae9bb5174b3695b9f442dc1146f0fee5f6811a743fd724773ce8d13f44ddd0656361917263765f7221ac20", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231312, "uuid": "313673b7-4fbc-43bc-8172-e7acd16cab81", "value": "T14A44120F3A6950FBED87C47109B997FCF279C1098606989B8B985D3E4EB018F076F685", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231312, "uuid": "5dd815db-8d81-4cad-89ed-ba2e0b900010", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231312, "uuid": "93ffe0f1-288b-4448-9386-7fe36f329dcf", "value": "6144:58LxB0mA5YjameWMUPYvX8eCU262cErcCe/o+pX5C8RX8zD:/Z2j9MvMrcOe/npX5w/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632231312, "uuid": "7f636e3c-239a-4f4e-bcca-b37f80397505", "value": 259132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632231312, "uuid": "e2962eef-921e-4a0e-8565-dd5f83017e1e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231312, "uuid": "c7c1e292-fedc-4151-a094-494c1bab60a4", "value": "9d38faec3253e9ce395c8970d03d8180.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58ccdf56-1b04-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632246602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632246602, "uuid": "fdadc180-2599-4e8d-aa0d-cad77b6e461c", "comment": "Malware payload (Mirai)", "value": "e0d4636e4b5133644389fea0b763cd95", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632246602, "uuid": "85ccf57d-03cf-4b8f-af98-829ba64ce2ff", "comment": "Malware payload (Mirai)", "value": "178ae11db5bbc164c855c1aed6803bcd564fda4e72a217f4a3a9c829b2788a21", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632246602, "uuid": "ce392fc3-a305-44a6-8dbc-0b3550d35efd", "comment": "Malware payload (Mirai)", "value": "4cc8276c3f9b7f2d84f88ca436fc433cf3a16886", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632246602, "uuid": "1e33baa7-a960-4423-b988-a9159d614c66", "comment": "Malware payload (Mirai)", "value": "b3e413b6eeb391b481a4cccddb5ef996880f6f686018829d595bfdf77aa6b87294cb89bd06ebb31a35acbdd639d809a9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632246602, "uuid": "79cdf988-f598-475a-aedf-c0fced7b3ec5", "value": "T114330264A19BA861D8B35839AD559DC1F5CE033EE3F6823007589C1C9FE914F2EAE14F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632246602, "uuid": "74cb9521-7649-4949-b368-b19279999940", "value": "1536:ULCIiGwOyOEG5D1pWwdGF8KMvLBqJRGdFIiD0:Q2l65539K0LBqHGdeiD0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632246602, "uuid": "961c388e-91c0-4a85-bdba-7f6c505ba94e", "value": 53488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632246602, "uuid": "9dd577a6-81aa-4b69-9363-8bb99685ee1c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632246602, "uuid": "11f631d0-2cba-4889-b979-c72da31255ae", "value": "dark.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f03dd95-1ab6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632213058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213058, "uuid": "e1822f28-d065-4af7-a457-6741500dccee", "comment": "Malware payload (Dridex)", "value": "df08266907aff394750374c5faf18bd7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213058, "uuid": "2f5c02fd-668d-4f66-90a0-21bf4338091c", "comment": "Malware payload (Dridex)", "value": "17a90d865c991fb07e663ca4cc74ddf15a2c4ee7a0ba6212e1ba9f7e9b730c7a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213058, "uuid": "af828718-c852-4260-92fe-486157f6693c", "comment": "Malware payload (Dridex)", "value": "f32ad51328afa063dbe6e3a19796b02bc59ee958", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213058, "uuid": "4ac83bc5-612a-4020-958d-ff3de1af6ba6", "comment": "Malware payload (Dridex)", "value": "4dca55c5da9fe94a9738732dabafdf8f755f7705b0b34837c6539edf940bd2c54e10041c4cdab1232478960aac21e7d9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213058, "uuid": "c58e984a-0a1b-4aa9-976c-836e0b519781", "value": "T167A5D020EF69E1E6C6B89F3E9408352727F93D75110D608CC392604F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213058, "uuid": "c7a8249f-bc07-4b82-8f88-2f0ceef47c8f", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213058, "uuid": "fec3afde-40c9-4de3-a86a-7b9866894b32", "value": "12288:PVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:mfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632213058, "uuid": "8690630a-59db-41a3-9bba-f30e30df5d39", "value": 2134016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632213058, "uuid": "e3aeea9f-6c0d-412c-af66-8125bca29fe5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213058, "uuid": "af424dbe-816c-4318-b250-de1431dda8a5", "value": "17a90d865c991fb07e663ca4cc74ddf15a2c4ee7a0ba6212e1ba9f7e9b730c7a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76ba6eea-1af1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1632238492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632238492, "uuid": "d56802c1-d76a-4719-bdca-ad90bc41b000", "comment": "Malware payload (Loki)", "value": "4b63d995e59be2ef2b778ac7d93a9df2", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632238492, "uuid": "c9287d0c-d0dd-498d-b07a-8523eb1c4bb9", "comment": "Malware payload (Loki)", "value": "17bd3e705cb89011155e7e1cba7967d7fb6c4c5f58f020726e8f12934bfa08d3", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632238492, "uuid": "8f99652c-1682-48d9-9f11-7614d880c1fc", "comment": "Malware payload (Loki)", "value": "6be5991a8468a947c8020a668fba4f7b9312ef48", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632238492, "uuid": "ba74f5db-a7c4-461d-ad69-f2d0b5b12888", "comment": "Malware payload (Loki)", "value": "4570c5a702f54a371d6481ab1c83928ae604a218734d45b681b96a012e30ae3adfa3fa4675aa8e6c2e0e5f5e472aa138", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632238492, "uuid": "0cbd939f-d6cd-4a2a-b814-93c09cb857a0", "value": "T13EE34903B844EA13D61893B57D9A8EEC3B217C489E9697EF3161BF8F3E362504C4615B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632238492, "uuid": "d41cd817-69c6-4f40-84fd-ad62b88ad32a", "value": "3072:0FxEtjPOtioVjDGUU1qfDlaGGx+cL2QnA4kZv/jo6XS8ZEI2pTihRa2PiqJiwW9R:yxEtjPOtioVjDGUU1qfDlavx+W2QnAut", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632238492, "uuid": "55d83c77-2b8e-47b7-9eef-403249479286", "value": 153088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632238492, "uuid": "9db983a1-1620-488f-8be8-46ef03b71bde", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632238492, "uuid": "a9b5a72a-191c-46ce-b63e-1ec8dfa748a3", "value": "Pagoswift_usd.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34e36e17-1aa5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632205740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632205740, "uuid": "c13ec83a-4b36-4be3-8d01-2c3201849a2f", "comment": "Malware payload (Formbook)", "value": "7391b91b7cfad25a4d7d95fc977243bf", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632205740, "uuid": "85d873a3-2269-4293-b0fa-eaa967245d4c", "comment": "Malware payload (Formbook)", "value": "1836e41307578c7d04069263ba049bb64348e13f1ce41798c7dfd6512334c8ed", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632205740, "uuid": "50e60eb5-113c-4efb-a77c-9b7a7671d2f6", "comment": "Malware payload (Formbook)", "value": "dd74431d4e6a5afd668fc4d7a904cdfbca4fe79d", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632205740, "uuid": "fa72ab25-271e-4378-89d2-6b93a0f7e907", "comment": "Malware payload (Formbook)", "value": "dc6667e313ef28df19acf3312d6f5923e38876d733ab4d52ef6a98a66f0674c8c3b4e45124d8bfb515abde3a0361f7c8", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632205740, "uuid": "0b4e186d-670d-46de-8678-0c40a4e5bce7", "value": "T1C5059DC13D47D89BF0DF6AB398AFC5201165AE8D9161C73D26927A2B54F3312309BE4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632205740, "uuid": "ad96a2a6-514c-456d-9024-120c6ea2ffce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632205740, "uuid": "d7ccbf9f-a4f7-4dcd-825d-fd2123b4e83c", "value": "12288:RwcdsmtiK5oUZotpxI9nhBKrPiDddqFi70UINPvhbX+uXVBuEkwGQK:6cy+Fo16nhBUMEdxN35OCfuEkwZK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632205740, "uuid": "1622fa7f-130c-4eaf-b05c-05501ffd4b4f", "value": 834560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632205740, "uuid": "1ded6891-9789-4a3e-8226-4e1fa3701231", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632205740, "uuid": "37fc761d-8f19-4964-9f73-ffda19398bf2", "value": "DHL-2622249_210811082342056.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "389925be-1b07-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632247836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632247836, "uuid": "592e3b78-65d8-4ab1-8488-10cd078dd7dd", "comment": "Malware payload (RaccoonStealer)", "value": "b25d22267068ad25dff4f2254b776d26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632247836, "uuid": "87c05259-54f1-45bc-bb5a-59cd7fa225b4", "comment": "Malware payload (RaccoonStealer)", "value": "187fcce7435c3f1dcccb75985131336f4365d2ac689c2ee22561285e9e37d261", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632247836, "uuid": "74c496f5-03dc-47d9-9fbf-5072f478a0e4", "comment": "Malware payload (RaccoonStealer)", "value": "72b2120c96fd07d57b0a771f4538e3e391e05363", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632247836, "uuid": "38075a4e-628e-4711-8270-8923d9ba6805", "comment": "Malware payload (RaccoonStealer)", "value": "cf6aba7b4653161fa9c333b2f0049df5c81403a60fedb9c8b91e17d3c73820d6bc6da8afdc9e83fb93ca3400f52b9b65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632247836, "uuid": "3fd0dfbe-8800-4cd7-a001-9e9a4c18991d", "value": "T1AFC49E2675719076F17240B0AE6CABA1167EBC7049324EAB73CA063D4FB15D2D721B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632247836, "uuid": "f2de2e2d-04a3-4124-8176-f01d652886b5", "value": "35279f0bcb93fbb246a2ff5f9995bdc1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632247836, "uuid": "8bf50a7d-35d8-4a6e-9a9f-e9c50e0460f2", "value": "12288:HPyvUhuDGncJlujEpr8qEFRkbNZ5tWDmp4NAc15Kp3CIF5j1QwZPRrE:Qwckyr8RkJXampEhoPa2PRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632247836, "uuid": "f1e4d729-619d-44a6-9af9-2635be398f48", "value": 584704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632247836, "uuid": "d4898a28-bd84-4a0a-aad6-4b5adcdae022", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632247836, "uuid": "52f90697-d558-48e8-aa35-7d0eabcb1fd8", "value": "b25d22267068ad25dff4f2254b776d26.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02fa59d2-1adf-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1632230567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632230567, "uuid": "3cd0976c-2bff-4d6c-a674-03dd53cb2577", "comment": "Malware payload (ArkeiStealer)", "value": "bd6ca935384d94f516196cda365a55c6", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632230567, "uuid": "bf074235-8985-4d75-8b32-e93052135f43", "comment": "Malware payload (ArkeiStealer)", "value": "19de7b0f27bd7c3f2e3881ae20ff9efaa73a1c676b611c2111422ef10c325477", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632230567, "uuid": "195de6a2-86f3-4d1c-91e6-62a3ec7819af", "comment": "Malware payload (ArkeiStealer)", "value": "a4bca9afdfc703766cd24648f5d54ffba234767d", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632230567, "uuid": "3ec1d5ff-4568-4f7a-b2e2-520bfc16ab38", "comment": "Malware payload (ArkeiStealer)", "value": "d28a28babfc44908650efc26e9497e0ab06e3650d4f3aa2742426eec32948af662de29b5554713e3081a0adcf08428d4", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632230567, "uuid": "febea367-7319-4552-8be0-7a30c566813f", "value": "T1F4E4122131A0C776C96F01358318E6E05E6BBD62666483772787AB9FDF30361BE5234E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632230567, "uuid": "811861cf-66a9-4b2a-8866-b14deedec9ec", "value": "019bced73b51911db702af2d47c34cb7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632230567, "uuid": "e461d7e7-c820-4ead-b83a-39e14f3bb848", "value": "12288:q9Uln8P7OHIrj/ySPnpFWCA+66/zOrnn7E4fuLbrXH8bTWeKgPp3+72AWVBai:q6l8P7Oo///GCA+6Iu7E4fuPrH8gMpS0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632230567, "uuid": "5662ee9c-a254-43a1-8679-0fef4dcaf03f", "value": 673280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632230567, "uuid": "a4f980b0-22d8-4a11-9614-345304992ead", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632230567, "uuid": "c5432bc4-a6f2-4e88-b365-f54894ab195e", "value": "bd6ca935384d94f516196cda365a55c6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e36fd6f-1aeb-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632235739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632235739, "uuid": "ac384c18-2f2e-4520-9a6e-ed77e333a70c", "comment": "Malware payload (AgentTesla)", "value": "ae12cf1192ea6c6e686379e5fdf21999", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632235739, "uuid": "5dd3e29c-6c52-4c45-8007-4dc5b842b958", "comment": "Malware payload (AgentTesla)", "value": "1ae97911835085cb0cc16be59fbe93944dbc280548f6992ba276fcc176752743", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632235739, "uuid": "1a70b106-dfc6-4dbb-bc3f-7cd42bd17ec7", "comment": "Malware payload (AgentTesla)", "value": "c055e2fe52ffcc37124aac008c23f1dd6440000d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632235739, "uuid": "758b66bd-d9ef-47f0-819c-2bad05afdd84", "comment": "Malware payload (AgentTesla)", "value": "8fbdb0d8a0aae9ae7f7720f03d2e3ed4681bf322d8985cbf3507aacbd3242b7b8ce7b8390838cb13247a87fec6079717", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632235739, "uuid": "db367964-7797-4827-aedd-54f69dfd36bb", "value": "T174C41226C66C9A39CEA5CBBD147540460BF2F18B3D12EE32ADD970D95F0B3B284149F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632235739, "uuid": "98a6b2aa-16a0-4461-80fa-423092a61663", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632235739, "uuid": "78a9c4e6-9cca-4925-990d-9e6f12076f5b", "value": "12288:Ww8wmtiK5oBzET2CQrJW6Pw7QQwjZIJj:B+FoB4bQrnCD9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632235739, "uuid": "14035283-620d-460d-943f-b8fd92e8659b", "value": 546304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632235739, "uuid": "275bbf21-abe7-4fbf-85fa-924133698193", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632235739, "uuid": "0a86e13e-257f-4cbb-bd8b-742e46391d06", "value": "ae12cf1192ea6c6e686379e5fdf21999", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "854bcfcb-1b30-11ec-8fa1-42010a9c0011", "comment": "Malware payload (OskiStealer)", "timestamp": 1632265575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632265575, "uuid": "3ec3d952-b647-42b8-b4a8-d86f637284dd", "comment": "Malware payload (OskiStealer)", "value": "55f980f9ea9a8ed2bc7e6dd877491fc8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632265575, "uuid": "04657c65-eae7-4f66-8be0-61cf45e405a5", "comment": "Malware payload (OskiStealer)", "value": "1c5686f42c5b67e4af06d0a7ae31c7b6ecb1b305cdd3f61c47276ea0ae6ee9e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632265575, "uuid": "afc3d2ef-7e95-4f38-a658-f61050c1384e", "comment": "Malware payload (OskiStealer)", "value": "bd9ece343f05e36a677fc9a517f3af58da498806", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632265575, "uuid": "0dc71df7-e51e-4ec5-b382-cd58361e4c25", "comment": "Malware payload (OskiStealer)", "value": "88650703ad8c9de304e906bea8294dd222af3155981f1b11abcd23c9dd4e290f9211aa6d1cc99aac5299cab2bcf6291c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632265575, "uuid": "0f3e6db5-eb7b-4642-b32a-4786039a25ee", "value": "T17AD4AF30179570C5E3327AB08BB3E442F5996D32AF9D92D93843F64DC2B3642E973A25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632265575, "uuid": "61983f44-ef9c-4549-a20f-cf882108c005", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632265575, "uuid": "b5561079-5e4a-418a-becc-c4a532d6d83e", "value": "12288:ELAYxaM8KuQ2Ec/6mAHbaZ5p42sWtmELdwbXc:hjQ2E26oJGW/LE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632265575, "uuid": "aa1ec462-bf84-4dca-a6a6-f7bb2df8343a", "value": 624640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632265575, "uuid": "5a97a5b7-f798-4c74-9af3-8e458659bab8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632265575, "uuid": "cdda4af8-2e67-49fd-85af-f5285d0cfee6", "value": "55f980f9ea9a8ed2bc7e6dd877491fc8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21f88dfb-1ab6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632213009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213009, "uuid": "0412ba83-dc44-46e4-895b-2d9656eca8d3", "comment": "Malware payload (Dridex)", "value": "0157d542f7610e2c4393cb3d089d1cbf", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213009, "uuid": "fab57f05-9fa6-463d-b3cb-312010d615e5", "comment": "Malware payload (Dridex)", "value": "1e1d0fe8c615616b737d9473136c352f9cbbf0b229eeffb1a1c609614559c7e0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213009, "uuid": "d82506a9-5280-40df-a1c6-8ba8e71110e4", "comment": "Malware payload (Dridex)", "value": "e2a932dc446943eee0110a2f36282f67c613af19", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213009, "uuid": "ee37d8e9-0d11-4ce4-86ed-7aca5d3de9f7", "comment": "Malware payload (Dridex)", "value": "f67725ab43c0cea0a79a7d307c87c7d592c7de584582b69af83f907ebbc4ad806d6e06c197d0088ab4bd1300e5852359", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213009, "uuid": "0b461268-a375-4237-b82d-240706d8dac8", "value": "T17FA5D010EF69E1F6C6B89F3E9408352727B93D75110D608CC392608F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213009, "uuid": "cb4a9029-d35c-4dee-838c-8a968ef28475", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213009, "uuid": "e5beac1d-987a-4c0f-8a87-2fe338324592", "value": "12288:4VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:tfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632213009, "uuid": "6249e9a1-851f-4cc8-9fe6-be10adcdc6e2", "value": 2240512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632213009, "uuid": "b7a1dc9a-eb77-43f8-9d86-5dc029f81c1b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213009, "uuid": "5d55c1ec-c59c-4478-86b7-a0f058f27e42", "value": "1e1d0fe8c615616b737d9473136c352f9cbbf0b229eeffb1a1c609614559c7e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dcd0dcb-1ab7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1632213512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213512, "uuid": "3747ca34-1ee3-4446-bffc-67ae9ac2f32b", "comment": "Malware payload (RemcosRAT)", "value": "c294ae1ac8a08a2dbe68da6d13ec648c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213512, "uuid": "1eb79a6e-d85f-4c38-bb5b-b294043d611a", "comment": "Malware payload (RemcosRAT)", "value": "1f4918be2cf303a764595480f17aa73b4aa91c6b3f8d9449424d9c7e879b7ad4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213512, "uuid": "26e39f9f-c3ae-4cc9-80b9-18822803e4ad", "comment": "Malware payload (RemcosRAT)", "value": "477188922060a71e2d5f4720ab6de1ea86f69bea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213512, "uuid": "70cb52fc-d5a7-422a-90c6-ac5efc6f1131", "comment": "Malware payload (RemcosRAT)", "value": "c2dc4ea30965df96137b340054ca8a67f2be71eb476229c8c3781900773cb4b5e0d9d30e9160e00f036f483a8edc3166", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213512, "uuid": "53c0b252-7805-4997-87f7-f1b5678c45c0", "value": "T1066512E038C23DE7E47ABEB972EDDE111549FA568E698A373F20C857C21FAD11A4044D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213512, "uuid": "0d9d52be-411b-447e-abd8-f72e0544cf72", "value": "c19c5a27cf193c3f49f1a5b91054e502", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213512, "uuid": "b3895be7-9bdf-45d4-b7f8-3d6e193471f5", "value": "24576:5dnw6NMI3svbnHrO+hPksYVLNj8YoN0ZkQS5sY1K7kjM0NHdFJRBIuNSae:fw6NMI3E7HrO+FfyNj8YoN0Z1mK7aNHa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632213512, "uuid": "9d824fe0-c778-4db1-800f-50ea9fded201", "value": 1490977, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632213512, "uuid": "9b083f6e-b7c8-4967-8233-2d1cac9a802f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213512, "uuid": "a53d50e1-c5ac-47ff-8070-770d06366df1", "value": "1f4918be2cf303a764595480f17aa73b4aa91c6b3f8d9449424d9c7e879b7ad4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15885af5-1ab6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632212988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212988, "uuid": "10f80aa1-0bc0-490d-ba20-2eefe3d983d9", "comment": "Malware payload (Dridex)", "value": "3328bc4db23c1ac6472b0fd23440005e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212988, "uuid": "a44fd319-9c6b-4096-8656-f988823c937d", "comment": "Malware payload (Dridex)", "value": "2016d2a49b0502b45e8863b899177c355986e3395c2173080ef62cde56d7b5f1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212988, "uuid": "8422e2fa-e8d0-45c7-afc0-f99c54c6c7c0", "comment": "Malware payload (Dridex)", "value": "c0dbe5498b3e400e1016a527b7a8e57f4662b4db", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212988, "uuid": "4ca07c81-f32f-4a8c-ada1-53b14f3a4101", "comment": "Malware payload (Dridex)", "value": "49cf2119f2785210ca416f4140fdc01a2bb49a27d4311fc65d94348a8de68a7bc92c698e2b7ae9212c7c3e79b163a5b6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212988, "uuid": "6e5b15a1-1e72-4eea-a7f1-ce6166e66587", "value": "T167B5E020EF69E1E6C6B89F3E9408352727B93D75110D608CC392704F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212988, "uuid": "dc9f4c64-355d-4a5a-95e7-4737d023ab4a", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212988, "uuid": "1ecd6628-9902-4fea-9109-ebf0f7d91faa", "value": "12288:YVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:NfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632212988, "uuid": "0fa74617-e6c5-4a41-9762-4753c01abaac", "value": 2297856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632212988, "uuid": "20f76982-58f8-4f7d-a90f-69f7406fb9ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212988, "uuid": "54cb3c44-bdad-4772-b239-df2e4c616287", "value": "2016d2a49b0502b45e8863b899177c355986e3395c2173080ef62cde56d7b5f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c63d627-1ab1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632210852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632210852, "uuid": "9f1b38dc-7c3b-43b6-a4fc-7ad83acb41f7", "comment": "Malware payload (SnakeKeylogger)", "value": "4072e0d90887ed3d3f876ec6d8cb8905", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632210852, "uuid": "5837fbaa-f81a-4dc3-b66f-5106c143f9be", "comment": "Malware payload (SnakeKeylogger)", "value": "21b7b5ae1d6ea1b55e45ba1af20f5077d5f70dbd131f605192f618181cce99d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632210852, "uuid": "f16f456e-5c58-4eb5-bd04-291acfab3c63", "comment": "Malware payload (SnakeKeylogger)", "value": "38261bdeef79bced49f2c56c5518d845e67a918c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632210852, "uuid": "99cd6298-4a09-4afc-8c04-04eeaf6cea73", "comment": "Malware payload (SnakeKeylogger)", "value": "7c91d5f7d36fdd651f26ddea5cf5a686bb5a803dda275ea01861880bb9cf76451041de4168db4ec05c152a6000671ca2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632210852, "uuid": "5615c302-8207-4563-b8dc-0d09193c4636", "value": "T17254E01A66F933E2E5BA0FF89D61B22017797DE1584BEE5A0F8070D90576B0012B2F5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632210852, "uuid": "6545f9cf-e9d9-4496-b378-89bc87d44803", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632210852, "uuid": "d1a5f16f-8051-4610-bcff-50ab30dfe827", "value": "6144:zttvJ/xapAOoJDus+DWh9UJTuP1H7hqruAyuQApbLJpfVvfKfxnA:z3FxkvmDhUQthqwYXD9vfKfBA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632210852, "uuid": "00629ab4-f880-4b58-839c-4d9a840de267", "value": 304640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632210852, "uuid": "937b3736-3fdb-45ae-b8f6-081e63324e6d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632210852, "uuid": "f546b7d9-b799-441c-936c-270098313546", "value": "Order List.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0447329-1b11-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1632252305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632252305, "uuid": "dadad173-b01f-4bd2-abcc-20bdbd249f17", "comment": "Malware payload (NanoCore)", "value": "a2f81b2021d159eaf2c7bcac2dfbeacb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632252305, "uuid": "2d0370c7-b521-4631-bd22-bb7d93a7f29b", "comment": "Malware payload (NanoCore)", "value": "2212f465e99a24acc6c23e12a7fd2e02cc8a26a004d05199562b28ecd66e175e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632252305, "uuid": "d6c142c3-180d-432b-94ae-e35db3858474", "comment": "Malware payload (NanoCore)", "value": "0e4b606dddccd8ad9b9297eb47128649c8bae9af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632252305, "uuid": "7cdc7335-f2dc-4ed9-9503-c1aba67face9", "comment": "Malware payload (NanoCore)", "value": "66e7c52c3b6a5104eca8030f9427a18a14cee8d3d00b0c3da4620d76cd65c633a6ab05c74691079d9d0e0c86cf96f6c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632252305, "uuid": "8b1f64ca-3488-40f3-af77-b5dc98a54ce8", "value": "T15DC27D91F3E09697D4ED4AB7E7EBD74003F0E3378861CB0E50CC5966285374593A2B8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632252305, "uuid": "428a1055-174e-4394-82b1-5e5ba115c63c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632252305, "uuid": "dc2e8486-6e47-49f0-8bbf-32689b1b2e78", "value": "384:zUCSUe7IxPqsAd2kC+wLki/JlfXDbGorMPFuge+bHK3MRUF+RCfxnT0UUKN7KQ:gCSdIxPqsw2v+wLb58FdhqFQRcNR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632252305, "uuid": "77854387-8d49-4075-a33f-df1d5da2a5f2", "value": 26112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632252305, "uuid": "f91c8db5-5850-4eaa-aa07-5af3fbfd8720", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632252305, "uuid": "2f5c7e48-f6f4-460a-a301-75b72e662af1", "value": "a2f81b2021d159eaf2c7bcac2dfbeacb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60d92e78-1af4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632239744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632239744, "uuid": "6502d666-42c6-4fbe-bb1e-27644e1bb108", "comment": "Malware payload (RaccoonStealer)", "value": "50f9234e477d8ebedab676c713329ded", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632239744, "uuid": "f5dc9c1b-39eb-4bc0-b516-17ab5824b32d", "comment": "Malware payload (RaccoonStealer)", "value": "22ab54095a6f6c605e638a4f4bc2c26e65d16fed3f9459871611f2368b64e431", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632239744, "uuid": "7e60a8e0-9b82-423e-9d55-a699dfc1b0e7", "comment": "Malware payload (RaccoonStealer)", "value": "8a56e2ebf594ec022d7b040f949cdbd8c30fa14e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632239744, "uuid": "28279ef7-b656-4838-9c5e-1440e97e0269", "comment": "Malware payload (RaccoonStealer)", "value": "c8220f64c3ea09fc271e8258606dc84ec6eb8de223cc8c3a2ee7ddc9cb57152b7efee0d8da1334faf8e1d56308a1e22c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632239744, "uuid": "c83fd89d-a4c8-45c8-90b7-c2e3ff7d9fc8", "value": "T13414CF0139E0CA71C57F157D8721DBA02A6AF83159708B873B5636BEEF342D0762A35E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632239744, "uuid": "b9d8de6c-8a8f-4707-9785-532043aea3af", "value": "98349bc8fa025f57a9d49df3092c15be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632239744, "uuid": "ba0c863c-80ff-47d2-be05-68593e214a4e", "value": "3072:WLWxjH9jkXTGQFfM5vTRz0DhoK5unGVm9T6SML8iIxAwjtqAG8:WGjxQF4e4GVAT6SOBwjtw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632239744, "uuid": "2ddf3b3b-6198-4e41-b79b-e6f9b3ff2409", "value": 204288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632239744, "uuid": "77896ca9-5409-4ceb-aeb8-47d6e74f8e6b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632239744, "uuid": "b1dee4e0-866c-492b-942f-5f6c9b2f0c80", "value": "50f9234e477d8ebedab676c713329ded.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0131ab63-1aa3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632204794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632204794, "uuid": "65e8c1f0-6a90-4190-89f2-15ce731605ee", "comment": "Malware payload (SnakeKeylogger)", "value": "83bbde4e7d1bef6cb52749b9bbb574f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632204794, "uuid": "1b3f5bbb-9e3d-4faf-bf1f-85d437973919", "comment": "Malware payload (SnakeKeylogger)", "value": "22b094d56c15792d63cc0cd2782a51d0fdf9aac9f34059dc0771130b9d7b6ad1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632204794, "uuid": "707b8267-72e0-452d-8331-26d8be10e333", "comment": "Malware payload (SnakeKeylogger)", "value": "e92184788608b441b74fe0a47b5ed705e4805364", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632204794, "uuid": "124a27a2-737b-4ad6-8d65-77b8873a7143", "comment": "Malware payload (SnakeKeylogger)", "value": "3c295632ab725ff976164f819963eeedaf168d681f1612db5705b4e74dbf3fb50f2b8ddd1b9e87b0b87e922afa662884", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632204794, "uuid": "65692bcd-022d-4b55-b7fe-ad55949ebe2c", "value": "T112B41865156E7D75C0B42B3A477317E51BEEEC402A3ACF896B21F279103C6D7BE4220A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632204794, "uuid": "00b62a5c-1ad8-4c52-bc4c-eb9fc54e1137", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632204794, "uuid": "8ee7b7b9-c9d6-4faa-892a-82886f9ed01f", "value": "6144:u6bccG+vfrspXuNrVoW+SM6u56OTznyouSmSX7:u9B+vTspXxW+SdEF6k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632204794, "uuid": "c420a7df-3539-480e-9a6c-affee7d011bc", "value": 519168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632204794, "uuid": "f7acca54-6484-4e81-97d8-f5b84b31b6f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632204794, "uuid": "ba9c8081-1dcc-4276-85d2-e3b5db93ac0c", "value": "83bbde4e7d1bef6cb52749b9bbb574f2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14141b49-1a7a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632187216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632187216, "uuid": "4030eed8-4174-4973-9a55-c57901077ce9", "comment": "Malware payload (AgentTesla)", "value": "a85138367e4f785b9a7c89b28218d747", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632187216, "uuid": "ff528a35-73e3-4c88-8ac9-434083a236c7", "comment": "Malware payload (AgentTesla)", "value": "23283c66ea09fa555b5975b56283f1dde594e8f0ccb3894899f450ed08195cd9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632187216, "uuid": "7135c804-316a-446d-a0ed-127f34c1ca0c", "comment": "Malware payload (AgentTesla)", "value": "01046d5d8a333bb2a840ef1f155687564adcfa2a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632187216, "uuid": "a12bbec2-8117-40c2-835d-9021caa4f08a", "comment": "Malware payload (AgentTesla)", "value": "7cc389749040cf998b05c18f026e441e7db1e7e7ab8f5a82b87f914a6872dec5599db075bf2e2e3f5666db43c874f028", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632187216, "uuid": "3503306d-c411-4abc-8681-868c99a8faf0", "value": "T18F156C394D2682F787EEC62CD08C1FCEDAA6A4837B919F1AD496D7C2025770FE49845C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632187216, "uuid": "d99e66fb-8364-46da-81f8-0b26006a0917", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632187216, "uuid": "d0e12c6a-da71-4d78-b5af-e4a000d5b200", "value": "6144:BoPskpy1kbDMyU9bNgacxQjrAp8Z8Aj/0TlF5Q7i7xv5qbaUnfsa5NYttMM:BGZba96aXAORr0TQi7xvcbrnURM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632187216, "uuid": "28f35277-ddb4-45a4-b6f2-45c3ab9cd893", "value": 878592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632187216, "uuid": "178aeda6-cbac-4b0c-b3b8-e75775d0322e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632187216, "uuid": "afec83cc-91f7-4b05-a439-74a56c4620c9", "value": "ENQUIRY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66d14f9f-1ae4-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632232882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632232882, "uuid": "5a4a55be-4ff5-4d64-a79d-f24ffa43b369", "comment": "Malware payload", "value": "21d6acf0f840ca43150ccd07320beb04", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632232882, "uuid": "e001b96c-15db-435c-a580-a6d0d17efe97", "comment": "Malware payload", "value": "2365909176f70ab061a66f7615303b5cf7e8c73c7676273a37dac32ce84bc9b7", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632232882, "uuid": "8bc69118-320c-47f3-a9a1-5d998ff5113f", "comment": "Malware payload", "value": "692acd79326ba7967bee842391aef08cf7c09b91", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632232882, "uuid": "b48cf960-127e-4b45-a73c-a1000aae3b96", "comment": "Malware payload", "value": "7a2b817797ddd1fa172025b5bc02ecb139ad82b136c634001d9809f97ce64060c6148abc333a4a66ad170d532011cf4a", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632232882, "uuid": "e8639e39-7e4a-4f5e-91b9-c668289c8b27", "value": "T181F12F3CE60376DD741D5E2D09CB77295A10C0B5C953E6F9C740FAAC69EEB40AB51238", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632232882, "uuid": "fa9a34a4-a1c4-462a-b990-4ca01aec416e", "value": "96:PzNTJhS9INIKMVGQRX8+HLz9spiINIVIWjnCQRX8Lnaa:PzNT2INIRRX8+Hm4INIVI8xRXAx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632232882, "uuid": "b6a4978b-e760-40fa-9848-7464bedb3ef4", "value": 7763, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632232882, "uuid": "77590291-e16b-4f21-b249-cc54582a2250", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632232882, "uuid": "3c05a439-f279-46a4-8ae3-0aa9c5d535c0", "value": "INTERAC PAYMENT.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b425e64-1ab6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632213213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213213, "uuid": "9447ead3-3a24-49cf-bd52-563651c924fb", "comment": "Malware payload (Dridex)", "value": "6a4ed2494c5af83d5483cb8e2bbb0834", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213213, "uuid": "0e468aab-9e15-4092-bacd-090ff03502d3", "comment": "Malware payload (Dridex)", "value": "23f533fb398094784810a1603978ebc853b1822b631a4d89c9381234c8aef01e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213213, "uuid": "57f4d048-222b-4b5b-8f1a-1236615f04f6", "comment": "Malware payload (Dridex)", "value": "b4494e34a8393376700a7da83d874b787e2c7934", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213213, "uuid": "1e2ca13b-42f9-46a2-a767-709f593bb5db", "comment": "Malware payload (Dridex)", "value": "fbd582f85cb73a2b113bed838d07e00f1b433d2d260fe21d11cfcbe6af12de91ac71d0f621624c135295282fb079bc21", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213213, "uuid": "f9db5653-80a7-45db-a5e8-8b70ecd1a308", "value": "T13065E120EE69E1E6C6B99F3E940835231BB93D75110D609CC391604F9EF82546E3F9AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213213, "uuid": "e575ab42-69d6-4cf6-a95f-29320181d2b4", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213213, "uuid": "7002f16c-e16e-4beb-8194-6deb1cd9fcb0", "value": "12288:AVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:lfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632213213, "uuid": "b365d269-3674-4b2c-89ac-5f1ea8438b35", "value": 1515520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632213213, "uuid": "83d40a46-fabe-49ce-86da-179c4f7b6e65", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213213, "uuid": "26ea09f6-8bf3-447a-a16f-9f66d0495c99", "value": "23f533fb398094784810a1603978ebc853b1822b631a4d89c9381234c8aef01e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec37bd51-1aa9-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632207765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632207765, "uuid": "e11c2c7a-4953-4cc6-afea-8a185ed2d31b", "comment": "Malware payload", "value": "f00246dd362f2c57a69b82099bf4e4ea", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632207765, "uuid": "dfbbf3f1-4077-43b6-a456-1b0365bcf9f2", "comment": "Malware payload", "value": "24dd0431722ac6c8ddd8a4260f60ce0d41063d58656590c249c65e8f075e22d6", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632207765, "uuid": "a188397a-5ea1-43cb-a465-5fb9ffdd47c1", "comment": "Malware payload", "value": "feacddec296d9a18d5bdab588609282e7bcb3960", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632207765, "uuid": "d42f2599-ca01-491e-bffb-716b33d51606", "comment": "Malware payload", "value": "eeda640b0a18f176c38f222fc010358a627d59237b3b425670b47bdf68863a57b625bf217ef380724b0444b20cadfae2", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632207765, "uuid": "bf0c1aab-119d-428b-a23a-a2788e8929d6", "value": "T1352633455F951852CC07E975008084AA314342AB9597E87BE2064BE39DF7FECFA1FE2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632207765, "uuid": "1aeb3047-d495-4d57-9fa4-01a8b8e7b3b9", "value": "98304:wwnD+xd63NmDrRCe/xC9KWsAyxr07JlK1pSecoPipV1FOt:wOD+xd63NmDrRCeRwyN07JY1IvVpV1g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632207765, "uuid": "a48380ea-2f5f-4c7e-ac90-9e85b9652f15", "value": 4656181, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632207765, "uuid": "b45b5159-cfcc-4be0-988c-8883657afce8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632207765, "uuid": "5c8533b8-5f40-4dc5-a091-fad61584bf90", "value": "commerzbank.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bbe4d31-1ab7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Stop)", "timestamp": 1632213428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213428, "uuid": "e27ece84-d1e1-403c-8889-1d4ecb901566", "comment": "Malware payload (Stop)", "value": "32d5e2971cdc72d60294fdb86aa6aa74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213428, "uuid": "35f9c634-928a-4812-9ca6-0b6ce5613700", "comment": "Malware payload (Stop)", "value": "2640e5c56cf421eba34ddfd83cf01e243d2cb69a2291863f9f650efecf56318b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213428, "uuid": "1c96d5b0-a314-48c9-aa1f-df8b001b7fe2", "comment": "Malware payload (Stop)", "value": "26ce6aa904f57f364c6adc9a497845a974d8f681", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213428, "uuid": "6dc0c5cf-46f7-49d9-ae36-a8cda0a99fa5", "comment": "Malware payload (Stop)", "value": "48b4dba184929fba2ad670171c99a294bbc803ff870bdb3adf6071f5c3bc56dac3d1bd4264788ee26b210cc5d4c66a6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213428, "uuid": "f825d213-800d-490c-b8a6-541dce5d6d5b", "value": "T17A05022066A1C035EAB712F459B7D3E8A56D7E706B3C95CB12D227ED26386E4EC30353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213428, "uuid": "8e280dc8-a969-4748-8ba0-0e3803f5b5ae", "value": "3a5e62b58b4a57118c6dbb55f27570fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213428, "uuid": "b0b4b05c-b16c-4a7e-b096-643034efa332", "value": "12288:YzAWGgMqDrqPkXp5MtZIOZKO3q4KwKiWJVF5vMSJd2Z+4K5Y2Ys14VcJEVWtRwfQ:YzkgnrxO61wKiWJT50wdu7KqhsGJWm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632213428, "uuid": "b9c850ba-9c5b-47e2-bef9-9679df2aa1da", "value": 808448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632213428, "uuid": "08c23615-ee2f-4da3-9007-a976d94ce02f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213428, "uuid": "515268ae-554d-4e3f-84b2-907a58a33f70", "value": "2640e5c56cf421eba34ddfd83cf01e243d2cb69a2291863f9f650efecf56318b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecefedbd-1ab5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632212920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212920, "uuid": "8bcb49c2-a11a-4d2f-8362-ba7de4790d20", "comment": "Malware payload (Dridex)", "value": "d5de87edc2c0bb8967314cf901545773", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212920, "uuid": "9de33cbd-5270-4b19-8a9b-9e66d79fc948", "comment": "Malware payload (Dridex)", "value": "27153a90f9fe46e2c8a530ff05783df3c6ba488dfe08efcc133e600da10bd359", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212920, "uuid": "db93653f-134b-4f8a-91e0-492dba1e67f7", "comment": "Malware payload (Dridex)", "value": "10dd28135f9b2b813a69be0c4f2a958c78cb2395", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212920, "uuid": "74a9cbfc-644d-4056-8901-cefc3fe7b680", "comment": "Malware payload (Dridex)", "value": "6983d8b3f224105652d8c2e249dd9380b305fb3826d4b9cffac1bb78d3b605f3a0b6a0cddda5513c14d053b33e747ce9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212920, "uuid": "115c7993-fdac-4622-9044-323c294bf702", "value": "T107C5D020EF69E1E6C6B89F3E9408352727B93D75110D608CC392604F5EFC6546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212920, "uuid": "c780fe36-9339-4901-95b5-3f1e76e5d5c6", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212920, "uuid": "b22179f3-497f-4cb1-b7fb-407ff675ecc9", "value": "12288:dVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:EfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632212920, "uuid": "899dcc61-d919-44ea-b8fa-73e96595f07f", "value": 2502656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632212920, "uuid": "f7f6de4b-8291-41fd-8fa0-82407fc0aa52", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212920, "uuid": "fcd72423-9bec-48b6-b818-6f73364b7bc5", "value": "27153a90f9fe46e2c8a530ff05783df3c6ba488dfe08efcc133e600da10bd359", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9e552fe-1ac0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (OskiStealer)", "timestamp": 1632217667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632217667, "uuid": "50f38f43-2eb8-4f2c-b10e-5134a3aedd1d", "comment": "Malware payload (OskiStealer)", "value": "06286fa6eceb22ef87f884f93b6277d1", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632217667, "uuid": "223c416d-d6bc-4b96-956d-f6745946bf0c", "comment": "Malware payload (OskiStealer)", "value": "27bc88fd389ded5b1102d7ef23245aceeb4a516c7291afc954abb876898aa42f", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632217667, "uuid": "cc779b2e-f53d-42a6-b82d-78edbd115dca", "comment": "Malware payload (OskiStealer)", "value": "3587aeb0114b266430edab58df048c8e133950f1", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632217667, "uuid": "f2bc6204-0e1f-4fe3-ba0b-db076e42ef2a", "comment": "Malware payload (OskiStealer)", "value": "e1c77a0425ae63b158b5317789cfd82bf4b39373afa8e161bcf2310d88fc6a9d438beca2f9d213f0152d8bf41254384c", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632217667, "uuid": "7b9c8093-b88a-4cc5-95df-8d153be55d3f", "value": "T14772CFFAAE6D30ABC720177E82364591BD2580E45834E66F359A812C16E8DE74B8F11F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632217667, "uuid": "d31560d7-34f3-4ba6-8605-79f8400b2750", "value": "384:dXP/GAPmdxWS7zlPbWdL/u12FdwlmsvCh:VP/kxrNWp/BFSl/vCh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632217667, "uuid": "8abf6cf6-3079-4db1-a987-ff589f831f30", "value": 16640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632217667, "uuid": "43865fa6-ae7f-4636-aac4-ba1c5bdf14e8", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632217667, "uuid": "60e64283-8277-408d-905c-c3f45ece8fc7", "value": "I Ordine di acquisto 49211.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3d91260-1ab5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632212825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212825, "uuid": "1f5748fa-1069-4f47-86af-c814e1f16565", "comment": "Malware payload (Dridex)", "value": "ac8f49ffb00c03758faeb8105469a9ee", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212825, "uuid": "bc57a4f1-2258-45a8-b1f9-8e9488461cf2", "comment": "Malware payload (Dridex)", "value": "27ea99792b27926654591347a69b274aba0c66b713324c4a79f4cbe719f244fe", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212825, "uuid": "919785f0-0b54-4c20-9755-145cc7e7c4cf", "comment": "Malware payload (Dridex)", "value": "42f0445fa362ed2a470c5494a5a60782ff6aae2d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212825, "uuid": "91e075bf-3063-4e69-a148-3e81b0e09f85", "comment": "Malware payload (Dridex)", "value": "13561fe74355c70c171e5972daf8a23f542fd9dc2d2bc470f5e1bcb0eaedfaa7197d0cce0a225687ddc7bd009be6bdd1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212825, "uuid": "a5ffb9d2-e501-4ed1-85b4-bd9789feb7d0", "value": "T1AFF5D020EF69E1E6C6B89F3E9408352727F93D75110D608CC392604F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212825, "uuid": "7a0cfb2e-8d66-4373-9d09-5d067b2e6e17", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212825, "uuid": "4efa1c4b-d30c-4c2a-9a39-9d1aa93f38e7", "value": "12288:wVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:1fP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632212825, "uuid": "450db351-d9b5-4d89-a223-a06c30953d95", "value": 3420160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632212825, "uuid": "dd0c83b4-7d3a-46c2-91d2-83a6ba699c5d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212825, "uuid": "d0aadeaa-1b42-44de-bec6-af4005cc2e97", "value": "27ea99792b27926654591347a69b274aba0c66b713324c4a79f4cbe719f244fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dec296e-1ad0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632224277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632224277, "uuid": "e763c076-ed25-4ba8-b7a9-52e333136dc0", "comment": "Malware payload (Mirai)", "value": "5420183c57ab90a3abf80d7a4b3d25bd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632224277, "uuid": "893b7c03-183f-4f23-84f8-50628a751817", "comment": "Malware payload (Mirai)", "value": "28628b2fb76771c8a750843c847dc6e22e303aba77eefd0840b168aedf2c4d50", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632224277, "uuid": "0e306ad9-b611-4c1f-baef-7a630fe15f98", "comment": "Malware payload (Mirai)", "value": "614571618facd00a2a43a2458f2730e4ddb4e7d5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632224277, "uuid": "04be37f1-3f3c-47f6-8739-98c586535460", "comment": "Malware payload (Mirai)", "value": "0c51b6dd76cdf078b018303c2ea817c52c20ebc112c53d4d4e024c3619c340d268a827a208eae5d35b45aa541549e364", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632224277, "uuid": "97665ce0-fa87-4a3d-ae60-11f3a03a9326", "value": "T152239DB3C42DEDD8C54902797A284E3D5723E50087271EFB5E9A86A59007EECF60A7F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632224277, "uuid": "fef6338f-34b3-4bb7-9a29-7db3102dfdc0", "value": "768:Ma1/hnrsPxgOH59EEvc9NhG/BJLtsqFaBNjq/CboO+O4ICnY:Ma1/tsFZ/c9NhA4vOzOgICn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632224277, "uuid": "97f3f2dd-ab1f-4254-ab9b-103773d18ad9", "value": 47216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632224277, "uuid": "e2c89776-9233-4bdd-809e-8554a15a8c38", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632224277, "uuid": "0f0121a9-24c1-4893-8a7e-1092d9fa4182", "value": "5420183c57ab90a3abf80d7a4b3d25bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2150aaa-1afd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632243772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632243772, "uuid": "8479004d-8071-4bf2-9678-fd96d3c8d6c3", "comment": "Malware payload (RedLineStealer)", "value": "e830188f97409d91fd05ecceb05a9843", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632243772, "uuid": "65303574-0cbb-4742-a583-b98c2bd4e65b", "comment": "Malware payload (RedLineStealer)", "value": "29c5edac63fee5c99aa2307b2b16bfb5123a51d3c9dfef6bfb1342e18a20d641", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632243772, "uuid": "7665c9f8-380b-4ab0-999b-a165b2a22868", "comment": "Malware payload (RedLineStealer)", "value": "5bd65eec351c89773bc6e668bdf9da07cf80281b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632243772, "uuid": "cc1f4801-6cc7-47e4-84a4-750d4b9ae355", "comment": "Malware payload (RedLineStealer)", "value": "68071e1e57512c03ca130f71c7a8f6de09a356e29e2d653f99a9c2193ae75008512cbec62b354961ed479297fed7d9e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632243772, "uuid": "3bef541e-a778-4861-a73c-5981e1c8ea29", "value": "T17064F1003AA0CA71C45706B54B63E7D15ABAB9721970C37B276B7A6EEF303D0762531E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632243772, "uuid": "39e08585-ac36-4319-9655-a9ac1f322879", "value": "b4a5f131bf57e0871ab3cda52113b279", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632243772, "uuid": "701fa35c-77d1-4959-acb4-97f8b97eb11b", "value": "6144:CyNA87eBvmVv09d/oLKok/FfjapH8JyzATloR9CZBwjtw:nC87uvmVc9dQKJFfjapHrAyWBai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632243772, "uuid": "fb7e1394-ac22-4761-9993-2619760fbb3f", "value": 311808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632243772, "uuid": "7fd18142-419a-4c82-b8f3-dd44fd8aafdf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632243772, "uuid": "b1d22f8d-ac5a-4c51-a1b8-5d2d66ced0f7", "value": "SecuriteInfo.com.W32.AIDetect.malware2.12468.11402", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac75f68c-1ac0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632217537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632217537, "uuid": "5564d525-1e39-4b09-aca5-9c1209478a38", "comment": "Malware payload (SnakeKeylogger)", "value": "efd50594b1b6bede39d7d2afcbd76ff6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632217537, "uuid": "2d29a535-6674-46cd-b414-655fc5ac742f", "comment": "Malware payload (SnakeKeylogger)", "value": "2b1293b20cb88a417733aea3d87b9380beadf13a37b94423e54dbe4f01697e32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632217537, "uuid": "8661a068-997e-46f9-92dd-246d4d6981d9", "comment": "Malware payload (SnakeKeylogger)", "value": "014687fb3f3591939a02e954abc64563ec8ea656", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632217537, "uuid": "a839b5b6-1d2c-4ede-88fa-a911f0577a00", "comment": "Malware payload (SnakeKeylogger)", "value": "041072d809802760dd875b5334095e6f0a9b037266cacb015ce33dec2b196f01018845100fce1480d94b7377c3c7a5d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632217537, "uuid": "4d77bd37-0847-4495-aef2-cf0b4a6a6460", "value": "T161B40152329E8714D7AA377121A2D3507B73BE7A6573D60E29DD708E4F3B2815E30B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632217537, "uuid": "c804243f-4331-47e9-ae01-db27e5c7a5c2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632217537, "uuid": "512d6491-db93-43fe-b8e9-12ac2c9feaa0", "value": "12288:kBIbw8eGGmtiK5ocTCwJ62Qa4hQI7Zgng0/8Yu6H:Vbw8eGG+FonbU2ZV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632217537, "uuid": "cc34c425-fd1b-49d8-97fb-ca6487ca8958", "value": 521728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632217537, "uuid": "73ac8962-5209-4ac5-b222-bb9d4e63add8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632217537, "uuid": "34fb3d40-e2d1-40c2-83e1-3c8fec55b7bf", "value": "swift.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4a5e152-1aa4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632205605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632205605, "uuid": "9dbd9a76-d7c4-428b-b534-eccbcd294334", "comment": "Malware payload (AgentTesla)", "value": "e68e538b1c10edc52d06e13c574d6d3d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632205605, "uuid": "7bb16627-a8d0-4b44-991e-586ea1fffdf0", "comment": "Malware payload (AgentTesla)", "value": "2b1836cf90a08f4c59b7c5567ab794ddea98dd53540fefecc9b19ccb2ab63bdf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632205605, "uuid": "aa6a5032-378a-45cc-b568-c109f2b0cc2a", "comment": "Malware payload (AgentTesla)", "value": "6ccfd45de0e06d1a295cc39a5d338c93522b6e99", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632205605, "uuid": "b5ffc7a2-51ce-467a-ae62-4d9d79b17ed2", "comment": "Malware payload (AgentTesla)", "value": "f0eaa1da73af47337f46ce88d4c07196805dbd67e10fe555041b0f7c173f0017ad7c7861096dfaea7434b464c630e1e0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632205605, "uuid": "54a97087-3de1-4c41-8526-475965b57e91", "value": "T14FC1A85963F9433AE5B78F35ACB383511274B613CFA6DB5C24D4113E5C207109E23BA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632205605, "uuid": "2732503d-86e4-41ec-8e55-d865a6fd56f6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632205605, "uuid": "8dfd1dbf-fe00-4608-928d-84022a7c38f8", "value": "48:6194Pbz4ePuJaXVw2bzj0nj6wn+3+sJwthq8PA9ihlaUVl2FnSfbNtm:KabzVw2bfAjPGvJA6ezNt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632205605, "uuid": "37dd8473-7120-46ea-9cb8-5caa91b7d9c2", "value": 6144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632205605, "uuid": "66d27d2b-7987-4000-90a4-b8911f531c51", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632205605, "uuid": "7722b3bc-0ad9-47c9-910f-496efe6ab288", "value": "cotizaci\u00f3n_023.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d52cdacc-1ab6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1632213310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213310, "uuid": "1178f0c3-cbf1-4bca-b3b0-820ef1a01590", "comment": "Malware payload (njrat)", "value": "456887551b403aceb4bdc4ecf679a776", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213310, "uuid": "00d89c47-8941-4230-a26e-b5e6b1ae4076", "comment": "Malware payload (njrat)", "value": "2dbfdbcac412f915fe1837b77fde449cac15d501ddf416c569ee50ded31cb806", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213310, "uuid": "39f8ed0a-0578-42a9-9d15-6dafe27c375e", "comment": "Malware payload (njrat)", "value": "8fd5421235600d6a858ce5500555c73451a502b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213310, "uuid": "8b81e558-8127-43cd-9965-efd8c29a10ad", "comment": "Malware payload (njrat)", "value": "1fea80910244d460b6f22fe5fb139ec1b064ff33b5ba60edbb48a5591f78a90c4c001837fdf581919aa1720fc055c3e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213310, "uuid": "1ca635af-5773-45fe-9ddb-5037fdf52208", "value": "T1EFF301375BE4E0F2D38AAE35F142A324E1AFCFEADF4516971761B94C5D23214886F280", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213310, "uuid": "364282a3-60d0-4661-9485-5a4ca175cd5c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213310, "uuid": "6d96df21-bf65-4c9c-b943-c4c53f7bfc4d", "value": "3072:8tzzYiwzzr3hcHkwIC8xzOZf/xA8h24fJj/Az:8tzz5wz3hcHwVK/vU4R7Az", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632213310, "uuid": "5e5b3197-6a80-4d0f-bbbd-df2a4d1041d3", "value": 172032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632213310, "uuid": "4dff814b-36b7-4019-9b10-463ffeb8a6dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213310, "uuid": "653dc7a9-f409-4e94-861a-342357259be2", "value": "2dbfdbcac412f915fe1837b77fde449cac15d501ddf416c569ee50ded31cb806", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f68919aa-1aa4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632205635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632205635, "uuid": "146c0edd-bab7-4bac-8d75-91564afcd668", "comment": "Malware payload (AgentTesla)", "value": "ebf36dfcdc7afa115688f355206f4386", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632205635, "uuid": "b72ddcb3-1f0e-4bcc-ad1c-afeb73f69c0c", "comment": "Malware payload (AgentTesla)", "value": "2e44e8d3333fd302f6783e4562e6cb3ce6d9d85daccf60dd100e7a56d872d96f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632205635, "uuid": "89fc2a35-7a4a-48e5-a36f-34d337bf16d4", "comment": "Malware payload (AgentTesla)", "value": "7fdce301113ce3625905549164ebb4a7eeb3a298", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632205635, "uuid": "462cfb49-77f0-4093-893a-2335b926edfd", "comment": "Malware payload (AgentTesla)", "value": "462e439c4e6aa9e8b9770b0408659fb3e5ed64d17679c6f111bdf9c8a126a0d246e27d72d68be20a2b5cc54808c7b803", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632205635, "uuid": "1a03f378-171c-41e1-bcec-1c8992f16a7a", "value": "T15F059DD17D47D89BF0DF2AB398AFC1201264AD8D9161C73D26967A2B54F3312306BB4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632205635, "uuid": "6ead8d1a-3442-475b-9386-b736de29f8d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632205635, "uuid": "8d15c61f-459a-4485-86a8-b40aa7db3967", "value": "12288:R/XCzPsmtiK5oUZL/cNDxq3Ae1IwKzk0x6kj+JhGxE6aVVJu6isetGQK:tD+Foyw4xKAtkj+J4CJOZK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632205635, "uuid": "67951e09-bce7-4c03-b1c8-67e0b1506100", "value": 836096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632205635, "uuid": "45c8ae69-b3fd-4322-afe3-c5b01d742ae9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632205635, "uuid": "ba33ca10-9b6e-46ed-9480-8dd2d7f8e1ca", "value": "Nuevo_docs-3452.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f4a23c2-1aba-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632214803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632214803, "uuid": "b53ddf5c-3c28-4dd5-ba28-3178cb08a19b", "comment": "Malware payload (RedLineStealer)", "value": "24a83981517c299c8b10b9dd5ca2620f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632214803, "uuid": "0ff27d9d-4dd7-4136-afdc-fc72ee7682e8", "comment": "Malware payload (RedLineStealer)", "value": "2efdbcfb3ed8051a345cdd46858cbaa873d5399d3c25f6bd954a476d2d873ae2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632214803, "uuid": "3e2016a0-8dd6-4fa0-90db-81cf45a62908", "comment": "Malware payload (RedLineStealer)", "value": "0bea4afc3cc88c972390b688799cd2127dd68947", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632214803, "uuid": "8c3259c6-6c8d-4e09-821a-1df0a38dc285", "comment": "Malware payload (RedLineStealer)", "value": "d7e18e49f3c7fa655a6db3319fa30944119bb75633b4fc647f66f5358e4f5ac88cf50616c0af41ebe296d3f1f1856fa5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632214803, "uuid": "2cec0297-41f2-46b4-a2d0-4365d42ddeee", "value": "T1D0352B18587FE02971E3EE916DDC68BACA9A55E3240C783A50B173374B63B41DE8F439", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632214803, "uuid": "22b27bdb-d42d-426c-8966-4fa103bade4f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632214803, "uuid": "9a122a95-4774-451a-bada-c5c6462459db", "value": "24576:sOjhXZmiO4nX1eVIJqqqnqqqOqqoqqqfqqMqqwKKhKKS0t7AR85xpNXamfATJswz:sOjhXg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632214803, "uuid": "7e2e1a94-9cfd-425e-8d31-d7e172e934c1", "value": 1079296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632214803, "uuid": "394955d4-6958-45ef-9d72-85d093bbfeac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632214803, "uuid": "a0f61763-0724-4a7b-9c90-2d922a66644e", "value": "24a83981517c299c8b10b9dd5ca2620f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23e58d64-1adc-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SilentBuilder)", "timestamp": 1632229333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632229333, "uuid": "d0fbf3b6-92be-40c4-8100-92797f6b56d2", "comment": "Malware payload (SilentBuilder)", "value": "a4babb28d14182b1a931cfa90e2d5f2a", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632229333, "uuid": "b1b820d3-f282-4dff-ad96-cb6ca8a97aae", "comment": "Malware payload (SilentBuilder)", "value": "2f3371880117f0f8ff9b2778cc9ce57c96ce400afa8af8bfabbf09cb138e8a28", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632229333, "uuid": "b76049f8-ceef-4a8c-831d-209a6bdab060", "comment": "Malware payload (SilentBuilder)", "value": "7021d4c5737d35af2e8884486856c574a6810bd1", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632229333, "uuid": "c080a00f-4eba-4c1f-b064-779f93e24d9a", "comment": "Malware payload (SilentBuilder)", "value": "b50691f2640db1ee4af3eb633bcb4160c42d9b77238a4954786514d08a5b276108b28d3fa2e3425a2724e0828b41883e", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632229333, "uuid": "bf8df285-27b4-48fb-a915-5bc0f804f9a5", "value": "T1E844D02676A1641EEC2D2B76A4BB53E02337FC404FD38BC76AA772223F729D14D26505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632229333, "uuid": "4d497e0e-d010-4f39-8f8f-57472aa98e49", "value": "6144:jKpb8rGYrMPe3q7Q0XV5xtuE8vG8UM+RnfzLI6+tqD2EwnoR57lj+QSGxGvJmmmK:kbD6qyEwoR5lTS/cJ3nLg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632229333, "uuid": "162637f2-d1d0-40df-bf83-0253eb0c8adc", "value": 270336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632229333, "uuid": "7978e9fc-cdda-4b45-8712-d73c256af39e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632229333, "uuid": "82240185-b60a-4373-a4fa-b3ce6553abe3", "value": "waffle4.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3311647e-1ad1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632224634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632224634, "uuid": "ea87bb90-3e3b-49fa-bc52-892aa295652f", "comment": "Malware payload (Formbook)", "value": "9bc9d44358cb1790f310b9c219baed2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632224634, "uuid": "b8940b98-381a-4b75-972d-51affcee2d75", "comment": "Malware payload (Formbook)", "value": "2fc82f206abb0d6d6b4d7a916be93b408ab78f848531917b3968b066a5a31023", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632224634, "uuid": "aa92e0e0-1882-4508-ab3e-f2974d3fcd2c", "comment": "Malware payload (Formbook)", "value": "45eb68fc4715519ed67a29fa63c1f7ccd8606998", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632224634, "uuid": "e3b8b59f-cdbf-43d7-90a8-1536f6937c2b", "comment": "Malware payload (Formbook)", "value": "d934d2a6d2f54516ee5153c5b8f25a17eb5c790a6c7e0cc5cc533d3ca9776d98ad0aa127e4da5dfc9154638f95b0d71e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632224634, "uuid": "85c99a91-b98f-42b0-95d4-66ca7d7d0f25", "value": "T109C40112BA6D4648CB9D33B625A19390BF77BD761873D50E24CE308E4B772820E75F26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632224634, "uuid": "83980a01-6e83-447f-9de8-4744ea9a95ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632224634, "uuid": "7041687b-2e4c-4c2d-bac4-efc815ded215", "value": "12288:QcZ8Ibw8eGGmtiK5oTycTmAmiPH3yLqTIZYyH5vWVgHPmeQmywAbJ:7fbw8eGG+FoucTmAmwHwqTIeyhWV2xtU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632224634, "uuid": "15cc6c6e-4060-4691-aaa2-fa83daaf10ca", "value": 589312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632224634, "uuid": "b9f99b18-1d27-4468-857c-84fc2325586d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632224634, "uuid": "c7f0c282-c657-4b94-8395-6a637ffebee0", "value": "Medtronics Product catalog and prices_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f2ccd70-1aac-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1632208844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632208844, "uuid": "d4350d0b-08af-4dd6-85b8-2ce994caf89a", "comment": "Malware payload (Loki)", "value": "fbd397939d2d7f80c0cb95e2bdb4156d", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632208844, "uuid": "1e9f92ce-245d-4226-8b0e-a8024e983c09", "comment": "Malware payload (Loki)", "value": "2fe83ac16c76153058e597777a8160b225a5ede4f6297ad9ed9f7bb990b4923a", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632208844, "uuid": "4389f01b-2eab-4db8-bc59-7997168d1daa", "comment": "Malware payload (Loki)", "value": "4f8a7345cf798a65a5edc4aff26320157820f950", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632208844, "uuid": "a73b2796-7be6-4947-8a1c-6f8969b6c759", "comment": "Malware payload (Loki)", "value": "c3ec2d3b7ba721b018b04c6a3f47d59902dc2e50ebdb5febf6093f19e61db0664295aaea49b4a5b30855804ca8a84cdc", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632208844, "uuid": "b2070d62-c455-4186-8348-922a81e8027c", "value": "T12D24CFA17681E506CA5863354DDADBF93732FC51AEA7430B3296B72F2F332D08943256", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632208844, "uuid": "a5b134a9-8a1d-4e0c-b3e2-a8d316cc160f", "value": "6144:PxEtjPOtioVjDGUU1qfDlavx+W2QnAABFjtJAqGGvi10UFZ86ZcjBxday9DxDtnG:AhJAqR6BZ8I+ay9DxDtDbG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632208844, "uuid": "91e218c9-eda6-495f-87cf-4cddbdffb535", "value": 227328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632208844, "uuid": "16753d2f-b186-40b3-ad40-b0dc5aadbebc", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632208844, "uuid": "fd6b854b-a771-4363-880c-c95c02084657", "value": "Payment.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "873b8cd4-1ac3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632218763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632218763, "uuid": "617e32d9-6929-4948-b7bc-ea2027fa0218", "comment": "Malware payload (RaccoonStealer)", "value": "40ca05a9a5263279500f2f3972b48f96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632218763, "uuid": "1d2904c9-8bea-4d25-a777-79e7f1a73bab", "comment": "Malware payload (RaccoonStealer)", "value": "3155e0baf18b8369f71e1cf4407774a78d13ae881a70c4083c02920354b4137c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632218763, "uuid": "59496ed7-b4bb-43ae-9496-a03925d08e0d", "comment": "Malware payload (RaccoonStealer)", "value": "5d2052eafa944f69d5336786b68a33cf48674c86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632218763, "uuid": "c18e8d4a-38aa-4c7c-a8bb-c99c14c77aa9", "comment": "Malware payload (RaccoonStealer)", "value": "1edcf6dc9daeee8f3645f7cf4d20ced3a2783bf142673cd33b227b4111156150b69fdcf9f76865fb973901e968cc395b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632218763, "uuid": "0762e8d3-dc28-48c6-9ef1-38615a9ea8eb", "value": "T1B3B4010D3A71D232C46766304B64EBE45A76B8B14565D38B3B66AB3CFF302D1B726306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632218763, "uuid": "4b11aee6-8c00-4fac-82c8-b5103bf64974", "value": "019bced73b51911db702af2d47c34cb7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632218763, "uuid": "cc762e27-82bb-43e0-a555-935369c0858c", "value": "12288:AW5yWQz2k4cXXi4+o1Ir6bc1HDAA/Bai:/CikRXXi4+CCWc1HJ/h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632218763, "uuid": "01800b50-5e43-4883-ad53-448fe451fce8", "value": 496640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632218763, "uuid": "879c5517-eabb-42ad-9103-435fdba73455", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632218763, "uuid": "29f0eb88-d672-4e80-9c77-b10f6d46d58e", "value": "40ca05a9a5263279500f2f3972b48f96.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb7261a2-1ac7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1632220568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632220568, "uuid": "a683e596-c764-4597-a7c9-2928f18312fd", "comment": "Malware payload (RemcosRAT)", "value": "7289cacc37ace16d2a22eb0adcf49e8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632220568, "uuid": "b6a9ee18-23fa-4630-b312-c6af90307d84", "comment": "Malware payload (RemcosRAT)", "value": "3234ff5f304bb4f6a94ca5e0d56073a6fcfbb65e582dff4a509351d44b039fe9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632220568, "uuid": "736df749-9d53-45c9-b988-18c8924b5076", "comment": "Malware payload (RemcosRAT)", "value": "9123ebcaf7e68128951be9160d259cb3ef769c9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632220568, "uuid": "3ee64749-c22c-4fcc-8abb-92d2fa46e6f0", "comment": "Malware payload (RemcosRAT)", "value": "bbe75264a92bbc724b6fe5828e6c5bf627653ba61fa72d09481576f664b422328a33316f0f72a1e0793844e1197ccdf4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632220568, "uuid": "1a440a2b-5d7e-4bee-8216-ac18754fc4c0", "value": "T18C357BD6738DCCE1ED25363EE98AB1A13620BBF93C124C49DD242F4E66B9551F48E843", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632220568, "uuid": "f19f77b9-7f84-47fa-b2f8-7d227c126097", "value": "bc8cc1eea5c25ce2056d7da92bd98134", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632220568, "uuid": "8473c08f-af68-4e0b-95b6-aaa9247d2a6e", "value": "12288:BSZPsJUL/MN/cen/VwTQBXcameDCnNmpeoAdrL7+o:bOQN/cu/VdBXKyCnEorP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632220568, "uuid": "ab88bba5-1343-4f69-8ade-874f0c711c23", "value": 1080320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632220568, "uuid": "f91c3c1e-ab1e-4890-8335-3bb46200b94f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632220568, "uuid": "fbd543d5-569e-4603-a783-c2a0204ecd2a", "value": "Waybill.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dc29406-1ac3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1632218586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632218586, "uuid": "6f588388-66c4-4360-9b40-e2695497445c", "comment": "Malware payload (AsyncRAT)", "value": "9c85e4fc3e5208af86fe6989b5207324", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632218586, "uuid": "2fffcb74-1f93-4d98-8d43-fef0a447d0da", "comment": "Malware payload (AsyncRAT)", "value": "323e2e3ed4a0b7b1251618b5bddd4dbe57a723485c4520c9d90ce8f5583b2542", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632218586, "uuid": "eaf6c6e2-f217-465f-9b14-0cad7bf62e9c", "comment": "Malware payload (AsyncRAT)", "value": "c8f2be1570f6649d8aa378d8417666413736c495", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632218586, "uuid": "0a763063-d01f-4d07-bfa7-e21604bdc3b8", "comment": "Malware payload (AsyncRAT)", "value": "b7db5f1ca611c1aff2fd8e6fbe83ba5b2730c94def228bf0a516313e287fba480c86430ac815c6356bf531f8605ace99", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632218586, "uuid": "4a41561a-2590-444f-855f-70e3003906da", "value": "T1E1A40142329E4618D79D7B7520A593907B73BE7A2873D64E26CD708E0B773814E31B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632218586, "uuid": "c0097907-115d-4181-b694-3f7bf2933025", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632218586, "uuid": "d35b5e00-2082-493c-8206-2012b01a39ef", "value": "12288:dAIbw8eGGmtiK5oYmR0yG/XXA7rpdHU0DeFS0:5bw8eGG+FoYA0yG/Xu3HUGe8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632218586, "uuid": "72112490-82aa-428c-a031-dc5021047b69", "value": 458240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632218586, "uuid": "ec8c7ddb-17e0-45e5-919f-971bb1d88496", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632218586, "uuid": "c5de689c-7750-4c2b-a889-6af1a2df841c", "value": "Aditi Tiwari-RESUME.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb19e163-1ab5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632212944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212944, "uuid": "d9d22d8b-74eb-44da-b7b6-46c85336860c", "comment": "Malware payload (Dridex)", "value": "ff6ae3a0ca8c19871dc521528c2023e8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212944, "uuid": "2be7070c-67cb-427b-bdde-f6c32dbe158f", "comment": "Malware payload (Dridex)", "value": "3432bef8f3997c82514d35c237cfac248e7befeef8254b09a84f75f7823a84f5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212944, "uuid": "b22b47e8-1381-4a40-a5f4-3288201fb361", "comment": "Malware payload (Dridex)", "value": "0d4a5fa1da85a9de1e76a4c1022a5f26b9614943", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212944, "uuid": "e209fc7d-e05d-4adf-b691-5f3f5463b64a", "comment": "Malware payload (Dridex)", "value": "55ec2a5ae657674fcb703fc336d6c9ce281dc37020f8f5418d90526246024083d8ba2a23044ae9de625ea7200b82f76f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212944, "uuid": "3582f7ab-74de-4438-bdbd-1603654e1414", "value": "T14EB5D010EE69E1E6C6B89F3ED408352727B93D75110D608CC392608F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212944, "uuid": "98cc0899-ade5-46ce-88e8-714b088cb4aa", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212944, "uuid": "4bbfc105-785b-49c8-a8e7-d9ec5ab3e9e5", "value": "12288:SVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:PfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632212944, "uuid": "4205ed23-e6f4-45fd-89df-32d6e932dbe1", "value": 2404352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632212944, "uuid": "53067519-a6de-4d04-9dda-ec808830df7d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212944, "uuid": "c274543a-6ff9-417c-91f1-7bbf889a84cc", "value": "3432bef8f3997c82514d35c237cfac248e7befeef8254b09a84f75f7823a84f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec3ded52-1b30-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1632265747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632265747, "uuid": "4ac5c205-eed3-4672-a5bd-cd58ce18d484", "comment": "Malware payload (RemcosRAT)", "value": "c6855b8e550bcdd88084643f747070ac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632265747, "uuid": "049acdb2-c020-4b1a-a839-e3cd2db4e8e6", "comment": "Malware payload (RemcosRAT)", "value": "34400bb7662a1aa0865f6ec06892fff142dd3ff8d09464141f75a96a42724493", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632265747, "uuid": "1bd471b5-a475-4d37-8a27-4a79405824b7", "comment": "Malware payload (RemcosRAT)", "value": "63cea165c1d9fcfcfa2fe8e6da5a185193e31c08", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632265747, "uuid": "b042e2d8-179f-4787-9916-c0b446d82182", "comment": "Malware payload (RemcosRAT)", "value": "4de4a2c084532f9b7114a072ec6d39c2149237e9f3194cbe1b90c9fa594d35a8fec4a438915b404990703c94d5664482", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632265747, "uuid": "7d5d7577-fbc9-4b92-932f-054487724a6d", "value": "T1CD358DD6B38CD8F1EC65353EDC85B249D7147BF67C224C09DC703A8A9AB0991B92A05F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632265747, "uuid": "8031a04a-22dd-4c03-a6fa-25af9eaee328", "value": "bc8cc1eea5c25ce2056d7da92bd98134", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632265747, "uuid": "b849d01f-4b6e-4e2b-90c6-8ff80b7fab3d", "value": "12288:lIspEfnP8N/seflQTshT8aqeTW39KqGeoAdrL7SUbDz5Zp:320N/seflZhTmiW3AyrPzz5Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632265747, "uuid": "54b97530-d3b0-4361-b2d1-8a4601e15912", "value": 1133568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632265747, "uuid": "93216f97-9a7d-4dd3-86d3-7224b03f3b5f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632265747, "uuid": "cf47758b-c2f9-4059-ae72-1cd9de666764", "value": "c6855b8e550bcdd88084643f747070ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b7c8531-1b13-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632252942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632252942, "uuid": "0e23073b-66ac-4974-be92-6f89a182917e", "comment": "Malware payload (RaccoonStealer)", "value": "afe2ba17c466acfbfc827dff9b5413a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632252942, "uuid": "1b02fec4-1b60-4690-8474-a01c7d1c0e26", "comment": "Malware payload (RaccoonStealer)", "value": "34ab5727b71b4ada8d2ee6b551bb9af7fde0751633ae8f0a12812304a7a36c1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632252942, "uuid": "449d21d0-fee9-424f-9fc3-8ece0b3fef3f", "comment": "Malware payload (RaccoonStealer)", "value": "0189017b624c27be97a8e20b45a28f8c11422e54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632252942, "uuid": "04d18806-fb44-4cda-8ee1-3aad48ca2d1d", "comment": "Malware payload (RaccoonStealer)", "value": "0fd1aa2ebe64cf45a0d281a69497051f666cfd94b07d66d075971ed336ac670c40b92d4f92a3ec587e7b22f8ddd9674a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632252942, "uuid": "c1aa791c-e977-4acb-8cd7-91b6e7632aad", "value": "T13514AD013ED0CAB1C5A305334462D6E01266FB7DFE68CD877759FAEE2E342905666387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632252942, "uuid": "1443cb67-a164-4d3b-acb1-20af49c37996", "value": "b423274974f58a1d1a63a5242c6dcf99", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632252942, "uuid": "d7584cd4-ecb8-4365-ad62-0c6f54b49e6e", "value": "3072:zVxXL7o02OrgwNM0Xt89w5m5OnGATcghhIIxAwjtqAWb:TAOr6ALfGAnhIBwjt4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632252942, "uuid": "a5ee5015-a0ff-4e0e-990a-6073df40da7d", "value": 206848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632252942, "uuid": "a82d2d0d-3a6d-47a7-833a-8dd6ae6e0306", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632252942, "uuid": "903dee3a-7be5-4a11-abbd-bf6a1adda2c3", "value": "afe2ba17c466acfbfc827dff9b5413a1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b569bf40-1ac0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632217552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632217552, "uuid": "83c8432d-19bc-4f08-9d9a-3a1465c6657e", "comment": "Malware payload (RaccoonStealer)", "value": "a5a2fc05ae169c31782a7c6f12e9a8c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632217552, "uuid": "09796c80-a823-47e4-920e-ca4f404f72ca", "comment": "Malware payload (RaccoonStealer)", "value": "35076221cd82da4a80f492b3a903b0c340ccc76725570ba41f9995c74c0bb485", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632217552, "uuid": "806e1ac2-dbac-402e-9e7e-ce8ab2c04444", "comment": "Malware payload (RaccoonStealer)", "value": "1ce3fbd2917674ac377fa5f86685e47896692178", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632217552, "uuid": "3831ccf5-69c1-42c4-b3e3-bd90a5190310", "comment": "Malware payload (RaccoonStealer)", "value": "4195f9850c4db242176f3609a733ba68de991dada5d6d7385b793cccdf420e81d6312ba6157ea796b800da9859e179ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632217552, "uuid": "e1bd4c68-499e-4921-9ed8-4e5ee1fcd709", "value": "T139B4E120A6D1C034E5BB12F45AB5C7B8B52E7AB07B3450CB62D52BEE16356F89C30397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632217552, "uuid": "7168ee98-0d28-475c-a1ba-6bd18a53efff", "value": "493d9235e00e760cd832c2d6518be9c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632217552, "uuid": "0ddb340b-1e8a-4f6b-805c-ee18ec3ae321", "value": "12288:0lvYa9t8fya1JYT/aKKntm37JCduWCEGkAVd2GGT:0S68fykMQns3FEAyGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632217552, "uuid": "73e695da-94a9-4f6b-b354-c794e3f65b1a", "value": 527360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632217552, "uuid": "86dde2a7-60d3-43c5-8ec8-d230e16cc907", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632217552, "uuid": "6af60d36-e420-4684-99f0-c7e0f6b547f8", "value": "a5a2fc05ae169c31782a7c6f12e9a8c6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e42b93c-1b11-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632252302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632252302, "uuid": "460fe352-1624-41f4-8eeb-c0a4e05edd49", "comment": "Malware payload (RedLineStealer)", "value": "d81eef7a65495422f3c5b39af44d1966", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632252302, "uuid": "5db5b7fe-911e-4fbb-b927-8b8acd86109e", "comment": "Malware payload (RedLineStealer)", "value": "35e01293efaa4e9616a8431691e332f49a939942100f6e6662145df7c4602040", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632252302, "uuid": "092bb933-66c4-4c3f-a46b-20eb3558c733", "comment": "Malware payload (RedLineStealer)", "value": "2170abcb733aa883d6dddd9f2c778dcea328f16d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632252302, "uuid": "81f635fc-a6cf-45fc-ba48-ef8bbea30492", "comment": "Malware payload (RedLineStealer)", "value": "838c6d3d0a3a9363432c18b016da2459a82b63c38559cf7ee7e44d49ac6b065cfbdc56749fd6051ed2d43f148e6eba7e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632252302, "uuid": "7a1163e5-8149-4200-be9c-1b6ebd74fa55", "value": "T12664E010B670CA72C5A351704BA0E7D06A7FB8625975834B2766767FEF30383B62634E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632252302, "uuid": "0cfb9ceb-c21d-4b04-9e6d-b97bdb6991d2", "value": "98349bc8fa025f57a9d49df3092c15be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632252302, "uuid": "fe7f7bb5-b309-40c3-9f32-4c5cdeff3a6a", "value": "6144:UyC+69pNZvGew0AZQR8uzFIWbOyfNATie2sBwjtw:9SNZv1wNGjA+HsBai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632252302, "uuid": "d5220acc-04c1-44be-acf2-057593598ce3", "value": 312320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632252302, "uuid": "4508a6e8-746f-44bc-8eea-cb69617de4e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632252302, "uuid": "9a43eb00-03a2-4cdd-90c1-e7bdac4574aa", "value": "d81eef7a65495422f3c5b39af44d1966.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcc1fd7c-1acb-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632222342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632222342, "uuid": "4a21944e-b913-413b-97b8-2d18f4479d90", "comment": "Malware payload (RaccoonStealer)", "value": "d257c759c17c76ead35ac09c8e59ebe7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632222342, "uuid": "d952718f-6090-4492-97f5-d4ff234fd8fa", "comment": "Malware payload (RaccoonStealer)", "value": "3661980c3d8bc4d3c84b4b67dff3527137f363a6e88967f0e379a2ab8ddac564", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632222342, "uuid": "aa13123f-17c5-4476-9208-1cfa4ee6785d", "comment": "Malware payload (RaccoonStealer)", "value": "431d394644e581fd59150cddd9cb515c7e6630f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632222342, "uuid": "d1575f2d-3893-4b45-b96a-310a12209b74", "comment": "Malware payload (RaccoonStealer)", "value": "97b163631b0acb49831ec4374d6eb137ebd9a312698b3e6621e737bace50abe7008a6a2e9fcdc75a565391db64f47eb7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632222342, "uuid": "bb731251-8fcd-43f0-8e5e-b98d918e6250", "value": "T18C14BE21FAD0CA71F557157087E0DBE02A6EF8605874878727562AAEEF34280762E35E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632222342, "uuid": "99f7f7fa-108f-4da3-88c9-051403395408", "value": "019bced73b51911db702af2d47c34cb7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632222342, "uuid": "e6dcbe38-07e5-4606-af42-070dcbb319b7", "value": "3072:BoxZnj8OkTGwFrey5mnGrm9TwsaYtSAC63YIxAwjtqAGK:OMK3GrATw++6oBwjtw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632222342, "uuid": "472e22a3-8075-4f0e-b407-1d867d5a247f", "value": 204288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632222342, "uuid": "723ba506-55f3-4bb4-a8fb-f58f35980a1c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632222342, "uuid": "9ad0728f-d1b1-40a8-a2e8-6adfc88fc7f1", "value": "d257c759c17c76ead35ac09c8e59ebe7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eac582ea-1b11-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1632252430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632252430, "uuid": "34d40a0e-40d2-4911-aa7f-e94d58e5869c", "comment": "Malware payload (ArkeiStealer)", "value": "5712d1bb9d35a5885dd4bdc27a08f335", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632252430, "uuid": "1d808459-d198-4ba8-824c-2b337065b2b8", "comment": "Malware payload (ArkeiStealer)", "value": "36d41de43aebe714bd9271beacc32e16b81143dcc6e4db40aaf305bb3a5b6517", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632252430, "uuid": "05b71a6c-1f26-466e-b564-964f03f9cdba", "comment": "Malware payload (ArkeiStealer)", "value": "a98e18118bde1396b2651b9f430ff215eeb4b971", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632252430, "uuid": "539b96c8-1805-4f3e-abe4-ec3d0d3287a6", "comment": "Malware payload (ArkeiStealer)", "value": "f9c662465bdc45d8f75dc237304cfe8f4a597660383fc50e8255f494b4bd57cf97b730a7b8d76dbb5447438020a48e3a", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632252430, "uuid": "d7d64956-743e-4555-b0f1-4a610897556d", "value": "T10F65E025D281F033D2B3FA38DD9A9B7F9B387E103914180B6EE82D691B253C1B519767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632252430, "uuid": "6d99f3e8-1f0f-4bc2-81e8-6f78a962b6b9", "value": "c32368f78c61cf2d9d6654d89861a9fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632252430, "uuid": "c4781093-422a-4a5e-bd04-f1b1e5f872eb", "value": "24576:HBuzcdGnDDaIFX9qOZGPlhOCoNS8M7TRNF8mTWncJ4UdVpK:H2DvXxZwxiURNF8c/7de", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632252430, "uuid": "3ca2564d-3445-4e44-8a0e-aac2bd2e494c", "value": 1534976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632252430, "uuid": "8ba6c154-455d-42bb-8720-a75b1c8e8d05", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632252430, "uuid": "92351c31-46ef-4d9f-a5e5-d6c2a1eb2d8e", "value": "5712d1bb9d35a5885dd4bdc27a08f335.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b08606d3-1ac0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632217543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632217543, "uuid": "c9a232c7-6ce2-47bb-8b86-2bbe517fe1b7", "comment": "Malware payload (SnakeKeylogger)", "value": "9f0e322a2301451a379d56b77c1c961e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632217543, "uuid": "59ba6318-6632-40ef-b9b5-3bfdbbeb7de1", "comment": "Malware payload (SnakeKeylogger)", "value": "36ddf4adf7c067dd01e7bedad5aedca5c0738c3c17db5e849b240cd574c40bca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632217543, "uuid": "0f62c5da-9f8f-4e4f-b74c-091b9edd9e91", "comment": "Malware payload (SnakeKeylogger)", "value": "84ba3dce671ddcf6366942cf92e2768be02e578f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632217543, "uuid": "415337a0-9a0e-4f6b-b456-ab036a464e46", "comment": "Malware payload (SnakeKeylogger)", "value": "3a274c9884b499d03830af8c3d36068040c5bffd1c640aa145cae708e33d7733aa29f4cdd7bd1ebfcc8d0a7be7ee2dda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632217543, "uuid": "8cec8c00-1e76-4f55-b521-d2e662031187", "value": "T150B41262795E595EC748377830A1C3907F72FD7A2583F68E28D8708D497B3C58E30A9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632217543, "uuid": "29f8b851-25d2-4aa7-9631-57bc5a0326ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632217543, "uuid": "db5a00b7-56b7-4069-82ea-981e4d23f693", "value": "12288:KlIbw8eGGmtiK5oXiinEccf65gYfTuGT65:Hbw8eGG+Fol/cfZ6qGW5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632217543, "uuid": "211edb76-783d-4d19-bfd0-2a59da6e041a", "value": 539648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632217543, "uuid": "0cf60909-64ff-41ee-95d1-cdc6fe42d9a7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632217543, "uuid": "4233cc12-7a8c-4a68-a2d7-1c4803512a3d", "value": "PO # 203603MR002-SP - 2 YEARS SPARES FOR INSTRUMENT AIR PACKAGE & NITROGEN GENERATION PACKAGE-JI-2036 OPFC PROJECT SAKHA", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ffcfe4f-1aa7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632206537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632206537, "uuid": "68784b21-430c-4a48-8ad7-bf56c5d0415d", "comment": "Malware payload (Dridex)", "value": "67ef650f5a6370328c9bd22871bde6cc", "object_relation": "md5", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632206537, "uuid": "1d852c02-cc03-49c7-a67f-b0f5720526f9", "comment": "Malware payload (Dridex)", "value": "375167a16a6beeee52910d6424eb884c631ada9bcb9843809eecd0475718e549", "object_relation": "sha256", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632206537, "uuid": "5cfdc5c3-6b7e-42a6-8dce-b5fc59552c4d", "comment": "Malware payload (Dridex)", "value": "17373df9451f20d4e644bce7a597f0a814327ae7", "object_relation": "sha1", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632206537, "uuid": "389d6246-7d10-4291-9584-85a8e78f0322", "comment": "Malware payload (Dridex)", "value": "f7c79f5dbcb9b75e91d57650fbbf42191dbd8ea493542ddff7296321e692d4f36e9f3a1c4654efe52608ddd8a7f667fa", "object_relation": "sha3-384", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632206537, "uuid": "25dc691a-a3a4-4392-8762-8dceb2e3c87b", "value": "T1AB14E07ABFFBE0F6C82E82F3417582751859D8349718CA77C6B3F929D4750D462A8C22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632206537, "uuid": "dc50cc7c-9479-4a16-a8b4-0703b2d14fae", "value": "f8e5a95d062791486e95dac858f22b5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632206537, "uuid": "cbe0d510-5caa-484f-8d97-ea72ae8727ec", "value": "3072:V9g3Pf+EEZ8x1ap5V5VSwI347BCbWKep1oAfxkOudNCes/C:V9g3PfK8xmgLaBCbWXNkOE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632206537, "uuid": "ad7bf961-1f45-4e67-bad4-43016df51c4f", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632206537, "uuid": "51b7e752-4983-40c8-b35d-b48f495d6c6d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632206537, "uuid": "a91e8857-0e78-4aab-9e04-b56224b75a95", "value": "67ef650f5a6370328c9bd22871bde6cc.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "072a5aac-1aa7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632206522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632206522, "uuid": "08d8ab84-d0b7-474e-9ede-58e40635007c", "comment": "Malware payload (Dridex)", "value": "77f4a188fcb8ec4f75e227cc9f9313c9", "object_relation": "md5", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632206522, "uuid": "4edfdce7-7b07-4ad0-be41-df2891629d15", "comment": "Malware payload (Dridex)", "value": "390707cb5b5790b45295bddcb749ffdde7439e1f4e9ef0b732597bf1b75fa534", "object_relation": "sha256", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632206522, "uuid": "867835b2-1a39-4b6f-8559-9bcb71ad2af1", "comment": "Malware payload (Dridex)", "value": "926b8afd825e2d2a3271d9f09cfd503863a434eb", "object_relation": "sha1", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632206522, "uuid": "012bf966-4022-4dd2-bbee-1789e3c39cbe", "comment": "Malware payload (Dridex)", "value": "1fb382f41098738be441a20c441a29f5dea51bf9550436fa2acd7f2a980e364951bc7e3620815144816779e25d9632fa", "object_relation": "sha3-384", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632206522, "uuid": "2779b00c-0261-4ee5-ab6c-0c239a5bca64", "value": "T13B14E07ABFFBE0F6C82E82F3417582751859D8349718CA77C6B3F929D4750D462A8C22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632206522, "uuid": "8381782f-6140-489a-adbf-7db9dfb66322", "value": "f8e5a95d062791486e95dac858f22b5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632206522, "uuid": "3e3340d4-6002-458c-bd9a-702777e3a114", "value": "3072:39g3Pf+EEZ8x1ap5V5VSwI347BCbWKep1oAfxkOudNCes0C:39g3PfK8xmgLaBCbWXNkOE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632206522, "uuid": "7cfb2f97-da77-48fc-9d71-a8d41f667960", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632206522, "uuid": "056c85f4-b457-4bc2-8ec8-f0117ac5745e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632206522, "uuid": "76f75e37-6617-46f0-bb77-51aba1c34006", "value": "77f4a188fcb8ec4f75e227cc9f9313c9.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a049c49-1ae7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632234014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632234014, "uuid": "0f5dae0c-726b-4dab-8588-0bda522f5b79", "comment": "Malware payload (AgentTesla)", "value": "46cd2dad44ec88996e7a38f5091bea2c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632234014, "uuid": "fb1d0cb3-7782-4359-950f-10ea688687c5", "comment": "Malware payload (AgentTesla)", "value": "39823b2744892f886cca256d6f56b3f3b706a095e2ee11ee8656067680f9acbf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632234014, "uuid": "ca30ef19-be27-4388-b99a-6ac1cb220758", "comment": "Malware payload (AgentTesla)", "value": "226cff6179492163b2fba3a0339322c7514750d2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632234014, "uuid": "50bd41bd-a065-4918-841d-276ce48e3bd2", "comment": "Malware payload (AgentTesla)", "value": "4fe0b065dba204e74a3359877bd2412d61cac30e66c4e573d12b17514c4af243475c1eed1bd18cc981842f1d5b248be7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632234014, "uuid": "775079b0-21b0-4813-9843-bedc60b753b9", "value": "T15FD4025175DE8518C39A3B7520A593903B77BE7A2873D64E29DDB08E0F336818E31F26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632234014, "uuid": "f660e39b-6326-439b-8714-3a71bba15deb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632234014, "uuid": "ae9539eb-5559-42fb-87ac-914a954d80f0", "value": "12288:w1VIbw8eGGmtiK5o+Oc+PcxugQ4F00r/1TKpWoTskZW:uebw8eGG+Fo+IPsHCI/dKpWzkZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632234014, "uuid": "4553c6b5-67f3-451a-95c3-745274b86012", "value": 633344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632234014, "uuid": "283157a9-5d50-493e-a3f3-a84189485879", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632234014, "uuid": "10022b71-70b5-41f5-a8e6-fe4a96e94b84", "value": "46cd2dad44ec88996e7a38f5091bea2c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f6e5081-1b15-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632253834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632253834, "uuid": "8eee671b-1af2-485f-af43-7df6ba95551f", "comment": "Malware payload (RaccoonStealer)", "value": "aaa3f3fccf28798a9370808462a16f4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632253834, "uuid": "49998435-e8de-40c2-b252-ce3ae0490e3d", "comment": "Malware payload (RaccoonStealer)", "value": "39d315cd7c986f2f67360720d9a390b4720799ad36ac88b668c9ced2beede0c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632253834, "uuid": "2b3b7be6-e464-4586-84ba-89491873a25b", "comment": "Malware payload (RaccoonStealer)", "value": "3a49e80abe55e507e95d3064d1f9dc46b4280db2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632253834, "uuid": "849cb1c6-68bc-4262-b053-2b9e37e73108", "comment": "Malware payload (RaccoonStealer)", "value": "f76bab5917c57d106a84c0fb500b6a3f8b0e1d1cb7ff4e4ff5b2b7770ea367d2483d14d8f28a70fc6c70d8e987c841d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632253834, "uuid": "36210d38-c600-4dae-8b5c-639a317a046a", "value": "T141B401013E90CA31E49765305830D2B45AB6F891F4A4EC8B7BEAFAAF3E316815671717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632253834, "uuid": "7ddce45d-6bb9-4720-851a-65758b0de0f2", "value": "b423274974f58a1d1a63a5242c6dcf99", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632253834, "uuid": "d7bf3e00-10ce-4bb5-999e-a25995aabff2", "value": "12288:Z/g0MKJFbuW7DcA08vEsmQykEcKMkBay:60ZJFbuM08vVVy/cUp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632253834, "uuid": "6348fe6a-2671-4876-9321-32301a9a80e3", "value": 499712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632253834, "uuid": "dcef45d0-94ea-4304-84b9-077f052cf449", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632253834, "uuid": "3c12b16f-5634-4b04-ab8b-0cedc9e7a30d", "value": "aaa3f3fccf28798a9370808462a16f4d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce48a65c-1aa9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632207715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632207715, "uuid": "b47c1520-5cb8-4797-97b8-b93a3cd91ed4", "comment": "Malware payload (AgentTesla)", "value": "f6569d3d61287be4e8e84c7c3735d9fb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632207715, "uuid": "f00f11f3-6081-46dd-b833-d9f2619a59c4", "comment": "Malware payload (AgentTesla)", "value": "39f623e41dfaccc9c71924279c94bda3f3c09a67c9542e698fed9d2df0516006", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632207715, "uuid": "836654b5-6840-44be-b33a-bb430454b122", "comment": "Malware payload (AgentTesla)", "value": "23975a1adbb15f63b5d6947eb0644af14861311e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632207715, "uuid": "ca692954-b6cd-4236-9bb4-d0457972703e", "comment": "Malware payload (AgentTesla)", "value": "e9bc589edd8ffd9e174fecd1e6ddd58a6d85d200494c1ac8bf5be2f8ba766c5e37d554ebaa9a93e67f996e6cf9b9fc93", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632207715, "uuid": "b8f9e4e5-4f9a-43a0-8582-84985f6f6275", "value": "T17C157C394D2682F787EEC66CD08C1FCEDEA6A4837B919F1AD496D7C2025770BE48845C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632207715, "uuid": "5a6da7a7-348c-4bc1-9f28-ac2b60ad01db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632207715, "uuid": "e16defe3-68df-43d8-bded-ae56b6c26de8", "value": "6144:xoJEMW25E2q5c3sPbOkLvkHeUMRmRv+kc//w0nQw7x+2wdyGOrMXPMMidFpz+a8t:xGsjBjkHe7ezhOF+FwrMX7KYrc5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632207715, "uuid": "e545114f-42f6-4438-874f-b69d9ee7ad77", "value": 893440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632207715, "uuid": "e4cbe078-0e9c-462b-9362-ef78aacfbf57", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632207715, "uuid": "4b29558b-c857-4778-8bf8-7ae113a9965f", "value": "SCAN-20210912YPT21-1929060.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae17d6f7-1ab5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632212815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212815, "uuid": "a8386cfe-c3ef-4599-ae80-f6e28521ecf5", "comment": "Malware payload (Dridex)", "value": "bc688aedcb6e879ec8ae103df75a5499", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212815, "uuid": "49c38835-bb80-4333-bdec-79e7b1b86f6d", "comment": "Malware payload (Dridex)", "value": "3a331fd39fffc75b55f8d33d31a08eac659dabafcf42d300846932d8ef8a81d9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212815, "uuid": "e7505d25-e679-417e-83dc-c3b1cdbecd54", "comment": "Malware payload (Dridex)", "value": "b292f2b9e7e3371f450bb30fed44433f96e7c636", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212815, "uuid": "9ca1cc4d-8548-4df0-9883-7e5911df7163", "comment": "Malware payload (Dridex)", "value": "404cad504d43eb839e71fb6c746ba99aa0879f1db109a977ff1d28246d24fd7f48b28e539e4d925135611c82e990e53d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212815, "uuid": "d4c656e2-5537-4439-a584-51fb9d7521b5", "value": "T1DBF5D020EF69E1F6C6B89F3E9408352727B93D75110D608CC392604F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212815, "uuid": "3c4b35a2-d264-443a-9a49-aae8857ba1f3", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212815, "uuid": "5e0928b5-5615-429a-8b82-1d03412a1fda", "value": "12288:uVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:zfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632212815, "uuid": "38e8fe90-8587-48dc-bbd2-422bc4b54c06", "value": 3432448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632212815, "uuid": "cd00d24f-6e74-4724-b18f-94c8b132df82", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212815, "uuid": "9d7e8b0a-2908-43f7-a93a-c77709433296", "value": "3a331fd39fffc75b55f8d33d31a08eac659dabafcf42d300846932d8ef8a81d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67c5901b-1ad0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632224293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632224293, "uuid": "9d6788a9-d71f-4cb9-946d-375033427617", "comment": "Malware payload (AgentTesla)", "value": "ac17800950670d071482f28123c73b43", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632224293, "uuid": "f97204f7-9d08-43f7-b58a-a573b92c5e61", "comment": "Malware payload (AgentTesla)", "value": "3aed33af5345fe63ad03e414798ca39fee0c738396e4264b69e536292bcc6503", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632224293, "uuid": "a10df7b7-0fc0-4981-ada7-1b4c589afd85", "comment": "Malware payload (AgentTesla)", "value": "30220b08913d54838be23b3339722b0dac156381", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632224293, "uuid": "7e005a17-8d6d-474c-beff-f83151a68b13", "comment": "Malware payload (AgentTesla)", "value": "298ff7a47a989a3eec4ce6d32c09aeaa645b6ebf6ad0dc2665cb766330fe67787950a6259425e96810c6bf394898818d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632224293, "uuid": "ba39e074-8b31-43ba-9cb0-19e02a3a7963", "value": "T164A4237FA80ED1AD982E6AB1344FAF70C2777401C4C116D749825CCE9BDC153ACADBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632224293, "uuid": "b6a295fa-38bf-4303-bdcf-c8337904a6ca", "value": "12288:6ajivFT7cQ2b3lZOeAxAPwP5c/Tfl0XesXl+u9bMucu5KQ:tjM2zlwxAPwBc/TBvu9bMuci", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632224293, "uuid": "004353b6-9932-40bb-af4c-29f7cb2a7b16", "value": 455238, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632224293, "uuid": "80e522bc-59f1-4d3b-8216-94f4f8236736", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632224293, "uuid": "b62f7591-5d57-4a7a-a9cb-ee66622cf01d", "value": "CONTRACT SIGNED.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ac82cbf-1ae5-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632233237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632233237, "uuid": "501fb9d2-64d1-4ad7-8eb8-ab737b465bef", "comment": "Malware payload", "value": "d740ce565155966701bfb76c6095799b", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632233237, "uuid": "096df823-492c-4c39-aff3-9d150f09a397", "comment": "Malware payload", "value": "3b402e2b8b57ce4f8b7d91bc7372dbbc9c2691de9d8e421dc825bd1ecf02dad5", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632233237, "uuid": "0b78e7ca-7bb5-4d37-8dad-189cbe35cf42", "comment": "Malware payload", "value": "c016f56ebb201725c3acfbaec9031e3363a52aef", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632233237, "uuid": "965cf8c3-9197-4996-83a5-4d6bfc14d141", "comment": "Malware payload", "value": "8d643bfa09617ca46a183f572e96e8c742dba2d9ef7321b933d643edcc2a788ff25015efa91b3315624868e2aabd6192", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632233237, "uuid": "6f3b7812-6b62-47c0-8b0c-ca63b67f93be", "value": "T1D2149157A9058AC3E51C93F8BE434ED92F066F08E9463EEB21157F8B7F742530D8A11A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632233237, "uuid": "ec99bf0e-e5d2-400b-a7f4-501a46fe8087", "value": "6144:oKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgCSPofSHl8oD5j:ERq55j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632233237, "uuid": "e36aa8ff-06df-44ab-8342-d3e3cdf1eeb3", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632233237, "uuid": "fe87d282-ad4a-48c8-b70e-a09b6b02e8e7", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632233237, "uuid": "f05c0313-9c7e-432e-98ce-0a29b388d172", "value": "qbot5.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "743eb88f-1ae1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1632231616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231616, "uuid": "144d2806-c00b-42b8-a896-0c8fc9347bdf", "comment": "Malware payload (DanaBot)", "value": "b8ce3bfde204d00436c9af5d970a8d9b", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231616, "uuid": "e3700364-5fb3-4a87-9feb-fdd72b7987be", "comment": "Malware payload (DanaBot)", "value": "3b5eaa821a45d73bbb5f8d7d89bca331ab1f44ffb488ba4faaedf9321c7fc5fb", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231616, "uuid": "2367f9a1-0a77-4dd7-ae66-53abf0df6494", "comment": "Malware payload (DanaBot)", "value": "6a52c3ec86010a43dcc7d7017f1015509955fe53", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231616, "uuid": "b92c875c-80df-4eee-a9b2-c9ec0fe51882", "comment": "Malware payload (DanaBot)", "value": "d4294832e60159f52bbadfa1e64f13409c1eab917d217c72f37cbbbfed4d1cc294f38140b0c5661a0627061afe319ceb", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231616, "uuid": "cf835607-5ee3-4920-8cb1-eb9cd1f4fc71", "value": "T160263384E5FA35BBDCD62B7142348CF67371BC2D089649146793FBCA3499422CA90F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231616, "uuid": "b9d7101a-42b9-43cd-a7b8-cf2ad8b32000", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231616, "uuid": "80b875ac-518e-4ffa-b904-10cc7dd59b97", "value": "98304:UZGpj2AKOEfkATDoAyCYOlsSid4Uww6HUhTuXmASHdeA3fqGTyB8w:UQYHfkATDLuf4UwowmL7vzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632231616, "uuid": "6c72ae7a-5ff0-4214-b80c-f55860ddc994", "value": 4649954, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632231616, "uuid": "f90b0608-dc41-4559-a7c5-a6cef7027c59", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231616, "uuid": "e19b787c-10ee-4c4b-be9a-a98094112e40", "value": "b8ce3bfde204d00436c9af5d970a8d9b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad2cca5c-1aa9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632207659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632207659, "uuid": "d7fa837a-834a-4f6f-83bc-6b566e263eb2", "comment": "Malware payload (RaccoonStealer)", "value": "c9661caa38dea46ddd786a2f5fc23706", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632207659, "uuid": "dec59c0e-7faf-4dbd-8efb-8c91a21b7310", "comment": "Malware payload (RaccoonStealer)", "value": "3c95dfb117835ab0edf303278462ff7a513a8b65c8e91d85b918e2eeaf3b9fb2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632207659, "uuid": "08cc1708-8def-487d-8903-638b62b782e9", "comment": "Malware payload (RaccoonStealer)", "value": "a1639ffb4e1d66574127871b5f3192f48796c3ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632207659, "uuid": "9250f7fb-658e-4970-a44a-076e3d34ad6b", "comment": "Malware payload (RaccoonStealer)", "value": "7629830c91354c0dfd2f7c805b7951ea7dc31a7e247e80461cfd37daa6bd57bdf9a86a2c13b314978c5e4e4420351d5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632207659, "uuid": "dab804c6-2969-427f-86dc-6ae99a177379", "value": "T148B4D030A6E0C031E5B781F899B793A8A93D7D716B3050FB62C626EB62347E49D31747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632207659, "uuid": "f39786b2-c668-4b61-8410-b468dcc17d00", "value": "3a5e62b58b4a57118c6dbb55f27570fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632207659, "uuid": "bdfe00dc-8a53-433b-a3ad-453c55f3d427", "value": "12288:LPjtO3oLWvywC8QIOWTpruI8vuz/XFKZ54jTOVs+NnOF2VKNk:ft5LfIPTsDuBSxlpK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632207659, "uuid": "1a425bd1-7b3c-4cd4-94aa-702fa3c46fab", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632207659, "uuid": "b4f90723-cd27-43d5-8a91-65d89a30ce8a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632207659, "uuid": "b79fd64e-5087-420a-a956-2490114fae88", "value": "c9661caa38dea46ddd786a2f5fc23706.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00f219d1-1aa5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (GuLoader)", "timestamp": 1632205652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632205652, "uuid": "49106dc4-b86b-4129-8d17-aa83033093d3", "comment": "Malware payload (GuLoader)", "value": "0a5321ff6f509deefd05f38b66e95b2d", "object_relation": "md5", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632205652, "uuid": "7dec2dcc-de90-4fe2-95e7-fef75066109d", "comment": "Malware payload (GuLoader)", "value": "3cb8ad904ec6bd47b22b42d82bee5fa856051f334d46eac17ee1cfe0c05c8cc8", "object_relation": "sha256", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632205652, "uuid": "466fde47-cc69-4b16-b1d9-1ce3c92b5ea0", "comment": "Malware payload (GuLoader)", "value": "4fdad0238aec64cc9da2c99800ecc66ffeabfeab", "object_relation": "sha1", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632205652, "uuid": "74835f2c-bd68-456c-890f-d45f5477b7f9", "comment": "Malware payload (GuLoader)", "value": "ddec48928c8bcc9f604dd0465f45acaecc582c4282b46a54493bf60651916ae1003ebf786fa6046892f22a4efcaf1e3e", "object_relation": "sha3-384", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632205652, "uuid": "1e69ba50-250f-42e6-b236-520fa63c193f", "value": "T1C5C35BA3EE60EAA5D04387709F55437CFC6E783555F43A4352C22A1E6DFAEC1881C782", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632205652, "uuid": "427a7ec6-f2bf-44f1-a51c-442f3606edd4", "value": "e74ab674c98727511df7eea47d84535f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632205652, "uuid": "755b3167-7f22-4fa7-a67e-2461df0d566c", "value": "1536:cDKStJHcfSlGd7ajMtlN86UndKkjCimbKc7USeDqDh:cLoSlI7ajAW60jClbKcgSem", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632205652, "uuid": "21ee09af-cb9a-4f78-8b9b-21ccf8e3e9c4", "value": 126976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632205652, "uuid": "800e43de-cb12-43e7-b7c8-3cb5c329c0af", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632205652, "uuid": "407f62d7-d031-4511-a10c-b374c54cd88b", "value": "Extracto Serfinanza_0115806577_12708_5986831206352_072353_15372374564615495018_293934859510040397.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef5aea1b-1ab6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DarkComet)", "timestamp": 1632213354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213354, "uuid": "865b90e8-8537-40fc-bcd2-e7f62d041dfc", "comment": "Malware payload (DarkComet)", "value": "b61d3fed042adb8672c5cd6def461489", "object_relation": "md5", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213354, "uuid": "7a975673-8a3e-44f5-b11f-a25c54a14561", "comment": "Malware payload (DarkComet)", "value": "3cea831e258d85288e46549b971fd07bb305652abceaf3bef7725145f39368c2", "object_relation": "sha256", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213354, "uuid": "6481934f-2ad7-478a-807b-94a8513afd88", "comment": "Malware payload (DarkComet)", "value": "3c479375f2ca5ad75c371133bf753808078e5b85", "object_relation": "sha1", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213354, "uuid": "c25717a2-9cdb-425e-beee-b8e657decd1b", "comment": "Malware payload (DarkComet)", "value": "80166e9d4457b10305250a2eb95c8b2cd875b4b5c9c3e3127747273f21c70b380b8a1962ec28eb92a3abf765c9d5592a", "object_relation": "sha3-384", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213354, "uuid": "46e4e36e-ca93-4f80-8d3d-22ef58554b55", "value": "T14FB4E0B1F144FC62E8C60DB1E11F36B117466F6AC998392F7584BD2E7CB3B45C0A291A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213354, "uuid": "88280652-f6fb-49f0-ad76-5081099b906c", "value": "f2d24d034ad8ae86f9dd9c6c9707e46f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213354, "uuid": "f4febeaa-2a33-49a2-adee-a2187eb741bc", "value": "6144:f9GGo2CwtGg6eeihEfph2CMvvqqSaYwpncOeC66AOa0aFtVEQfTo1ozVqMb8:f9fC3hh29Ya77A90aFtDfT5IMb8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632213354, "uuid": "35941a32-0822-45d0-8102-596f2f828358", "value": 533806, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632213354, "uuid": "339b1947-5030-4029-98c5-ab1b4401e6e9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213354, "uuid": "51d38212-f4d2-431e-84c8-bddb9617c4b5", "value": "3cea831e258d85288e46549b971fd07bb305652abceaf3bef7725145f39368c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39fb65e8-1ae4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632232806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632232806, "uuid": "1148fe9f-0886-4d47-84b7-899e8bd89cc3", "comment": "Malware payload (Mirai)", "value": "a1b71f6f2bb7c0e31902eaa427a5b7fc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632232806, "uuid": "6b8f7461-f184-4c84-a738-5171ad232f56", "comment": "Malware payload (Mirai)", "value": "3d680566828455d2dbf2475f180a69a8802f3411f8c69e01c4cabe88cd712fdd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632232806, "uuid": "cd9d82b5-4b2a-43e8-a6f3-ed22a6a70ffe", "comment": "Malware payload (Mirai)", "value": "424401a6e202f10ad7183a9b186bc9c1de6df0f8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632232806, "uuid": "83754d22-345f-476c-94a9-8130a0a13fd0", "comment": "Malware payload (Mirai)", "value": "a30d92098e2d239394642d93b9e0bded5e5155dac8d5740179231b8674f8c708f028f6af9c954327a9bc7b2b1245ef51", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632232806, "uuid": "e37edcff-9b50-43b5-a0ba-11275e9faabc", "value": "T14D23010BC106DD29C3FF613E22EB2F8B8670561EA6905A34FE50723C548B6A6FFE5505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632232806, "uuid": "aac8eeeb-e685-4517-8690-0735ae2092bf", "value": "768:icL1R5vQpLU2Q5QxmToj6BJMspuhY7g/nbcuyD7UWyq/tp7QiV4NN:icLnx+ZQaYTlBJb7ynouy8Nq/AiGNN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632232806, "uuid": "85f6e898-c6b4-4968-8130-24fe2d6aae1a", "value": 46384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632232806, "uuid": "9b46149a-4615-4881-a8fe-aa3ac7dce6d7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632232806, "uuid": "dfae0b76-1abd-49ad-ab85-768b3a77772a", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7afe590e-1ae1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632231627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231627, "uuid": "d1418894-9aa9-479e-9f17-9fa0342b662c", "comment": "Malware payload (RedLineStealer)", "value": "8c8cd7478805fa63aab9a42657628bc2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231627, "uuid": "71a94824-2e8f-401b-8450-7601c91f6377", "comment": "Malware payload (RedLineStealer)", "value": "3d74698f4119e6da540d9f9bb89a486800cfc10c08df6c57d47e64937a728551", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231627, "uuid": "93a5a758-08d2-4879-a12e-4410deda1b97", "comment": "Malware payload (RedLineStealer)", "value": "6f9b01a82f8d8a9c677081d7b9fcec7b5aed8603", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231627, "uuid": "7e5f8641-eefe-474c-bf82-0246350dfdad", "comment": "Malware payload (RedLineStealer)", "value": "aa5f962b3d4a3b78b8ca2c22e2f96c40e4fac9f7027213d560915bcbcab400e26c4e9d684fc69459af48decce025cee9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231627, "uuid": "cca40341-7c6a-45a9-adac-1f2da59dd9ba", "value": "T111E38167A1D0507AE39F7B34E0623F0736A9D624298FB788B0CEB3DDD91854C59F4268", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231627, "uuid": "3947c7cd-a0b4-47f2-992c-42dc73e94f48", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231627, "uuid": "ff7f45bb-bc31-480e-ae28-381b92a20d5f", "value": "1536:lbCoV6mTdxGolB+F5yqN2spkNvunitmkVMLrXXnRF:coR5dwUp0kJHuLjBF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632231627, "uuid": "ab2054a3-e3e3-4aed-b1b5-cb6cc3abb9e2", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632231627, "uuid": "a329abb9-3efe-4329-92f3-66e9ad0af554", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231627, "uuid": "4f8c7c9e-19ee-4456-9019-0b27e6ddc94e", "value": "8c8cd7478805fa63aab9a42657628bc2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51ef328b-1aeb-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Quakbot)", "timestamp": 1632235853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632235853, "uuid": "590ca5c3-2950-46d2-93e9-7a96c45905fd", "comment": "Malware payload (Quakbot)", "value": "e121f5b1079748488d88fd470b2edcff", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632235853, "uuid": "6ec63952-1ce0-4995-8c64-ce5cc96c7a9d", "comment": "Malware payload (Quakbot)", "value": "3e4d8dbf5c6618929757d3fdd74a5c07be9d5e72a24b7272d31660698abd76b3", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632235853, "uuid": "15b0307a-a64e-48f5-9464-b3ee16baf95e", "comment": "Malware payload (Quakbot)", "value": "e114e9c97b0781e6c340aeb110657bd232ef1e7d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632235853, "uuid": "6e3e5d1c-55c8-4fa2-9877-335b9de0a272", "comment": "Malware payload (Quakbot)", "value": "d798ee0ea9a111ac5227c9136f34468f6022e63e5836fa5fc2ca8038b2c73e31128a929d8bbc037a1c4d491b6a4e860f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632235853, "uuid": "2ce3ce2c-70a6-4bf3-a2b4-dc711ce7b87f", "value": "T131149257A9058AC3E51C93F8BE434ED92F066F08E9563EEB21153F8A7F742530D8A11E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632235853, "uuid": "05b9d194-8d5f-4e96-bd0c-b99822f1ad36", "value": "6144:AKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgOSrofSHq8oD5O:Y1F55O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632235853, "uuid": "c11df421-1648-4829-b338-2110a7893e89", "value": 203776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632235853, "uuid": "9e3a00f5-1c20-4255-8ee7-556fc8f74443", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632235853, "uuid": "4699c9c5-050c-4d8d-ac05-7f936bbe900f", "value": "Payment-607227206-09212021.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9f17f7b-1ab5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632212835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212835, "uuid": "d9687d20-a0b8-401f-8d3b-ba10215bdacf", "comment": "Malware payload (Dridex)", "value": "00f01ccbc4bc5c1f31f79c175d8a7be4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212835, "uuid": "17746b2f-1f13-45cb-bd11-f25fd3120ed8", "comment": "Malware payload (Dridex)", "value": "3eef836b9486751724183fbc41b1476fc7e78a19f9c41b5e569b0ac463028fcf", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212835, "uuid": "dccbdf25-ac1d-4c7a-951a-5673fb31c2b4", "comment": "Malware payload (Dridex)", "value": "462368430111e71ae3c89814d417775bca3290f9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212835, "uuid": "ace237cb-b782-4885-970d-e9596f4743d2", "comment": "Malware payload (Dridex)", "value": "4027ce8f1f0815c7c6b2d0dfb8b9ff647f87c2990a22bcef93d1bc45061a1aa550c6173a186924c88d823717122b7fae", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212835, "uuid": "210c58cf-83ef-4759-aaaa-db5b107a980d", "value": "T100F5E020EF69E1E6C6B89F3E9408352727B93D75110D608CC392604F5EFC6546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212835, "uuid": "e4b663da-24d3-4e47-9aab-efa111f83c8d", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212835, "uuid": "7237ba00-9049-4b6f-9758-3cb1ec876d62", "value": "12288:1VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:sfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632212835, "uuid": "ac2934ea-7c91-4058-b7df-28a1c409d8f7", "value": 3330048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632212835, "uuid": "909e7ee9-0497-4ca9-8695-5bbed1786553", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212835, "uuid": "66bc38ad-b7a6-47e6-a495-8f2cd3b39f89", "value": "3eef836b9486751724183fbc41b1476fc7e78a19f9c41b5e569b0ac463028fcf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55fa09fa-1b09-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NetWire)", "timestamp": 1632248745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632248745, "uuid": "736904ae-df71-42de-8b56-a0dfe4dddc7a", "comment": "Malware payload (NetWire)", "value": "efbc39d4e89b9cf1402acacbc11f7816", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632248745, "uuid": "e439d307-77a9-4111-8fb7-f3c556b4bc77", "comment": "Malware payload (NetWire)", "value": "3f032c4e18eced05282ae0a19f738dfef527c2281ce7bebaa28ca028941903f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632248745, "uuid": "65672bdc-a79d-462d-86d9-932f81eca815", "comment": "Malware payload (NetWire)", "value": "9d6d12ead04e8a7fd75e300d26701a6d9725cccc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632248745, "uuid": "fb0f8845-5d79-463d-8598-c83e551f1b05", "comment": "Malware payload (NetWire)", "value": "5ad9f3f5748e19cad15b3b3b76f30909d9694978818f865e81586c2f3eb68e8130c7dbc6c31a7fed703564869daedd8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632248745, "uuid": "ed7db924-b4f5-4d8b-89a6-e5c267564271", "value": "T1CE356CE3B799C8F0EC24393EDC4E7384271AAFF52C134C88AD747B498965651B46A48F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632248745, "uuid": "c7bfc29a-c788-4d52-997c-abdd479c17fe", "value": "bc8cc1eea5c25ce2056d7da92bd98134", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632248745, "uuid": "24153b28-bcf5-422e-9bb1-5e0483f79332", "value": "12288:lIspEfnP8N/seflQTshT8aqeTW39KqmeoAdrL7SUbDz5Zp:320N/seflZhTmiW3A+rPzz5Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632248745, "uuid": "9a282b6e-92cc-4176-b76b-14a600734f8f", "value": 1133568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632248745, "uuid": "328e8d2d-f9ed-42f0-a594-130f7db507fc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632248745, "uuid": "8c6d1e23-bc63-43e3-965c-15437fe9aa6c", "value": "Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3908ebae-1ae4-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632232805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632232805, "uuid": "3a0e7cbc-49d2-4a18-a94b-de5296627613", "comment": "Malware payload", "value": "fadfb75d28556f3ddf825fafdd98c91d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632232805, "uuid": "f6acef98-93e4-4c40-9979-20d439bd16a8", "comment": "Malware payload", "value": "3f4d6b02e23944c9e58521c44d4cfaa09d4a0f5150f7707ea36aaa12052e957a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632232805, "uuid": "1fbed2c6-571a-4d80-8d65-08d4cc6f863b", "comment": "Malware payload", "value": "3adc6a8b836a28e33f12f8e4d90921558509afd5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632232805, "uuid": "4a2b1906-fab6-475f-833b-f912f43749fc", "comment": "Malware payload", "value": "363a010240b4fa684a2b895388adff538e54bc63db04dbe251b6b306064c5075fc1e99bd0463e301f691f301b7d0ecb9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632232805, "uuid": "1420b9a2-70bf-4db3-afdf-30176b614842", "value": "T14363024193D4F151C4BA2EFEB3AF424554BD7DB6C36D719901AF866301E63E209F08EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632232805, "uuid": "40a04202-eb5f-4629-9ecc-f810d0dad550", "value": "1536:/P4jN6F7eG2JxCkdYqpBKOR89lAmIQoV1Plm3hO8mmlIW:/gjqgouhSORG9A1PwROLq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632232805, "uuid": "40747c86-3c2f-4131-b0e4-2e6712c52c7d", "value": 68592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632232805, "uuid": "afe77081-2d0a-4dc6-8dd4-b2147ac26116", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632232805, "uuid": "3312069a-8af8-4ca5-83fd-b499787dbc2c", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d537900-1ae0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632231094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231094, "uuid": "10626c63-3d47-44f6-bc99-68918b784909", "comment": "Malware payload (Formbook)", "value": "079627807595b290ff96d0d78f981055", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231094, "uuid": "d60064cf-b582-4381-84d8-9bd4f12eefc8", "comment": "Malware payload (Formbook)", "value": "3f5c235293cfdde26a725b19b3cbaefc44dae026b7dff9124002f42e564df18b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231094, "uuid": "df101ab7-3aca-4818-9877-b24da8a828e8", "comment": "Malware payload (Formbook)", "value": "603608992b441698bf93baa141c32017be8b9cc6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231094, "uuid": "66fd6c72-f05f-475f-b0b0-186bade8e8c3", "comment": "Malware payload (Formbook)", "value": "4f273117115ea6ea061429dec93bf6926834e4ea831eaf852b05cc372a9f4ad18ca2121823165d1a177dff0bf7fd2642", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231094, "uuid": "7c315eef-fb09-4f55-acff-50439a5d7e6e", "value": "T17CC41202725D1A44DB9A3B32216163407B73BC765A73E95E2ADD70CD4B3B6828F70B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231094, "uuid": "93cc9ac7-5eba-4ffc-82ca-20b6960f77e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231094, "uuid": "33f95f51-90f9-4290-9b5e-f80fd62fbcdf", "value": "12288:iDfS0Ibw8eGGmtiK5oBXj7QX0vsl/xggE8llG7CGWqaQVyMj2rtJxd+V/r:QSXbw8eGG+FoB4YsVmgKeGWW/2RjO/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632231094, "uuid": "313814ea-c0aa-4297-b64b-948f36fb360a", "value": 589312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632231094, "uuid": "b8395775-41eb-47f2-9e17-0162195f74d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231094, "uuid": "36b566e4-1192-4885-97b5-dd007be48dc9", "value": "079627807595b290ff96d0d78f981055.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93ec5aaa-1ab5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632212771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212771, "uuid": "23e821b0-efd4-4f4c-aa54-4d38fd6ea1d5", "comment": "Malware payload (Dridex)", "value": "8a3c1b0d6ea02e8f91b22c00e28861fe", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212771, "uuid": "229b4a50-d973-448e-91af-6c51c4c794e7", "comment": "Malware payload (Dridex)", "value": "40779eaea905f54cf2ad50973b92114acd97446a9b53beb8e76a7e50e0d261d8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212771, "uuid": "f760be30-70a5-4cde-9d8d-dc303ac7d08c", "comment": "Malware payload (Dridex)", "value": "ee29fed539b59652eb984ab5f4a708a3d193a766", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212771, "uuid": "267d54c0-be05-4bec-ad52-dc91d7d91faa", "comment": "Malware payload (Dridex)", "value": "5740e37ef045d36cdfb0495996d796374798f9ae570074354b8453d2e3bf8e331105eb5fa45e596971c46c9dae6ed838", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212771, "uuid": "99b137ea-1403-4617-8b5a-f98a9d1cfac7", "value": "T1CB16E120EE69E1E6C6B99F3E9408352317B93D75110D609CC391608F9EF82546E3F9AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212771, "uuid": "f3cff026-f420-42ae-b051-d5dee0202a1a", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212771, "uuid": "e12229fc-a758-485f-9748-fd64d0171cec", "value": "12288:eVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1E:DfP7fWsK5z9A+WGAW+V5SB6Ct4bnbE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632212771, "uuid": "16991f21-1a67-429a-a3cd-00ee8e866ec9", "value": 4268032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632212771, "uuid": "bc22fda2-b483-4a51-a93e-b0d1e879ff6f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212771, "uuid": "6d5118f7-ec53-4d21-ac7b-a71b71d527a1", "value": "40779eaea905f54cf2ad50973b92114acd97446a9b53beb8e76a7e50e0d261d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f7707b6-1ab7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (FlawedAmmyy)", "timestamp": 1632213461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213461, "uuid": "b6b7c907-bdd2-4142-91a8-2b809137a35f", "comment": "Malware payload (FlawedAmmyy)", "value": "396516050d0007c1c88d579bbe2a8f2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FlawedAmmyy", "colour": "#7CC188", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213461, "uuid": "d1d8b48d-288f-4b8a-9b2f-89150fd04270", "comment": "Malware payload (FlawedAmmyy)", "value": "40b479d2688a659e57197715395f78c1801d4ed2ff275d59149c52ec9fb01498", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FlawedAmmyy", "colour": "#7CC188", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213461, "uuid": "b2dd1d65-1d1c-4e60-bd56-cff6096f59b8", "comment": "Malware payload (FlawedAmmyy)", "value": "0c8275a4e2b41bddbf164eccd020c55f8e436fb7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FlawedAmmyy", "colour": "#7CC188", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213461, "uuid": "2ed44b69-f0b5-4124-aad4-41eb521c8a03", "comment": "Malware payload (FlawedAmmyy)", "value": "ab9cd666ea86bb6e54f867372ba10686ac8d2bd391922eb226153daa0ec92e384e7c8a6a410fcc9507fe4bbaea00efe9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FlawedAmmyy", "colour": "#7CC188", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213461, "uuid": "36e72df2-94dd-42e5-aca3-673a22bf758c", "value": "T18C25CF2679C2807BD272067189EA6772E9F5FE640E37890B1388EF2C5976D01DB1277C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213461, "uuid": "dc14cd6c-d1e5-47de-85ea-203f13195407", "value": "45896ed265b8bcb24cd556dfd99e122f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213461, "uuid": "5bdf2ade-27df-455f-a24f-fec71dc03521", "value": "24576:OMjPJ5g9KVGrdNikfu2hBfK8ilRty5olGJsx2:LJ5gEKNikf3hBfUiWx2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632213461, "uuid": "7e5e0d26-7476-4622-845a-baa311cc6f68", "value": 998456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632213461, "uuid": "4c87a078-dd92-4964-81da-83fdab0a0dfc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213461, "uuid": "921abbbe-7490-4a0f-b4b3-c11a8d864323", "value": "40b479d2688a659e57197715395f78c1801d4ed2ff275d59149c52ec9fb01498", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bf9a8ca-1b08-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632248218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632248218, "uuid": "6d74c72a-01a3-4e2d-9067-14e885eb2c53", "comment": "Malware payload (Formbook)", "value": "baf2982217b31a6fe69abf4008f58329", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632248218, "uuid": "c66a750c-8c7f-4704-a4d7-3b3ec9878735", "comment": "Malware payload (Formbook)", "value": "40da3a76d7dfbe395b879dc9b090af73483617c65c7c433975490c0a22e4a71a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632248218, "uuid": "f4c30992-6c11-45ae-9b4f-527631dcc8c4", "comment": "Malware payload (Formbook)", "value": "b8dadf51e395b219e7300ba5d0e95fb9d7d9f509", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632248218, "uuid": "011e6366-c8f0-4c53-ab62-87d96801cae4", "comment": "Malware payload (Formbook)", "value": "124a7ef70050c81d4e48db9b7e9a92453b5054c1f1476deb69dae6570bd02f76f208370856fa64cc8ce7932b85601f0e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632248218, "uuid": "6fd8ac11-496a-485e-9e49-d6e7920c65e6", "value": "T152441246A4D19AF3DACF9A325213A759E3FEC6C481054747CF200F7A7F20667CA0A676", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632248218, "uuid": "b1447901-807e-47c4-bb28-40b983fbccc3", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632248218, "uuid": "618b276d-f0c7-4e54-a13f-099103dbd943", "value": "6144:l8LxBjFO09nfR+z/ZSGoxaHGcLFBZ/uxap1Z9EfbNdVE:0FRnfMz/Im9fZ/uwxaNdVE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632248218, "uuid": "441e02e1-70e7-4929-8e85-c93380614611", "value": 269932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632248218, "uuid": "54fff6f4-2d9b-4c7c-a122-9f281f25fd69", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632248218, "uuid": "e6ba2f9a-2330-4aa7-8227-ca7d7a2e2713", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c67e67d-1ae7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632234045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632234045, "uuid": "be83f474-3675-402a-8654-c9d35765e90a", "comment": "Malware payload (AgentTesla)", "value": "0859837bc7715506f2ec83b4f13ff905", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632234045, "uuid": "0216f087-1039-4d37-9eb2-d1b788c48d91", "comment": "Malware payload (AgentTesla)", "value": "40e59195356c316947670675bad76cc6c1746375f88ccab829b11d86d372d42a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632234045, "uuid": "5cf81ac5-88e4-4557-9108-dc219c40bf1c", "comment": "Malware payload (AgentTesla)", "value": "55284623bf87250ede23ee1fbe12468e701e694c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632234045, "uuid": "cb6dd519-2140-4464-bbb8-489aa8cd171f", "comment": "Malware payload (AgentTesla)", "value": "2521f4864d3c8ae69c00219bb995a8fd01d04263038989187800bcdcbf6578c7bad5c9452f90536d6d0389dca2337e78", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632234045, "uuid": "f7063082-ad11-4d77-9fc5-2c33c2dea962", "value": "T1CFC4233CA265E775D56CA7BF102182495B74E28E3A13C27FBFD7B19E7C02361042D4AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632234045, "uuid": "1cea9c80-6bed-4300-8184-c4dde5fa1f43", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632234045, "uuid": "476eef60-6229-426f-8585-2dd4c8e44e24", "value": "12288:CxEgmtiK5oBCtu+PmBjFaAO670sJsQUB5dQpN/+:o+FoBzSmBjFJ7nJavQ3m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632234045, "uuid": "02e0b785-4f9e-4cb6-bd92-250ea6304df5", "value": 552960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632234045, "uuid": "a54eddeb-50f6-4109-a018-a45b8a2ee962", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632234045, "uuid": "45cec74f-ca47-40e7-8756-92748cbc8a9d", "value": "0859837bc7715506f2ec83b4f13ff905.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e2a7aba-1af4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632239605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632239605, "uuid": "9a9caf67-a0d3-41f9-99cd-5075b7e686cd", "comment": "Malware payload (AgentTesla)", "value": "a10aa0e7766ae73dde7d42df0bc09ecf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632239605, "uuid": "0de22fc2-4afe-443c-9c19-fe1f08e13ffb", "comment": "Malware payload (AgentTesla)", "value": "427be513177bb1ca578b4258f68dca288046a5c3ac8044560e45971649a00e3b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632239605, "uuid": "8d421d92-f8c7-4a91-8879-fa50e4d2fdec", "comment": "Malware payload (AgentTesla)", "value": "dbf4b97e5fb53584ce292ef52522c39835c40a64", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632239605, "uuid": "1e0defcb-1332-442a-9d4b-fa2f3b82e173", "comment": "Malware payload (AgentTesla)", "value": "39000d2595625428273c665a244d4a2064d2588d3e9b345f7b4d320e892b450335d6a8d208ba735e47d21d0f5f9a6a7b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632239605, "uuid": "722aecb1-87ea-43d2-afe2-1749313cb448", "value": "T11F158C394D2682F787EEC62CD08C1FCEDAA6A4837B919F1AD496D7C2025770FE49845C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632239605, "uuid": "f5e4c6d0-fbc4-4a55-8e51-783f8afaca54", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632239605, "uuid": "6a58e6e9-8297-4034-a03f-f27097bf0802", "value": "6144:3GA/7xzyoNQA0vDWd1PFhsMQU1prH/Ukp5jzJa+MI6dTEVTfU2432tDON0fGJFZ:35xztv0Sdza8rBBaJDdElfBO64", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632239605, "uuid": "52a6cc86-ce19-4245-8961-ea7e01fcb687", "value": 910848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632239605, "uuid": "acd1aab8-6155-4605-a69e-06a5eec74ca7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632239605, "uuid": "4e16b886-d598-40c8-8f4d-6aa5dacf17cb", "value": "Request for quotation against visit to your website.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c79d44b3-1ade-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1632230467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632230467, "uuid": "9b26d34d-2524-4818-b4a3-ae8dac5aab32", "comment": "Malware payload (Smoke Loader)", "value": "563502a9e6cc49beb81719ceaa0ee9f2", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632230467, "uuid": "e3a5218b-4418-4bc7-a8aa-f3d47cdee7f1", "comment": "Malware payload (Smoke Loader)", "value": "4389750bcd2f3b674dd5452cc38d70e6e9dbd09b2acdd8eea0d11de1cbb68b18", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632230467, "uuid": "1cd9c75a-937d-4a36-a76a-71199f583815", "comment": "Malware payload (Smoke Loader)", "value": "1dee5d6f24abe713120ddfbd66675bb51029feb4", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632230467, "uuid": "57e75479-b912-4370-a160-cd03178e6fa1", "comment": "Malware payload (Smoke Loader)", "value": "c9b230a4c977b389b0d69b51dcf8c6d3c037231ed8f9586df0968ee349e342839fa73996e09e24c6f7c4820c3149b91b", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632230467, "uuid": "7b525ace-4f6a-4fc9-af4a-f499547e00f0", "value": "T18614BF11F5D3CA71C5A705308720EBE02A6AF8715974878F2756B27EEF243D076263BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632230467, "uuid": "5e48a24e-b146-4379-b807-18ed79bd9440", "value": "019bced73b51911db702af2d47c34cb7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632230467, "uuid": "9346f043-d00e-4b24-bcd8-67ef18e4bebf", "value": "3072:PSxZnjgvOUyd9ybs5mnGkm9TPzW+mu7IxAwjtqAGK:KPzd8GkATPzW+mu7Bwjtw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632230467, "uuid": "179dfc5e-51dd-4bdb-9d49-c70f29908ba8", "value": 203776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632230467, "uuid": "7e5aed93-d568-450a-88c4-f98428d0749f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632230467, "uuid": "055177c7-1ac4-40e9-b127-63c645c83b24", "value": "563502a9e6cc49beb81719ceaa0ee9f2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f5f1a03-1a76-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632185517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632185517, "uuid": "aaba2de1-52e8-4980-b993-65a15f3ccb4b", "comment": "Malware payload (AgentTesla)", "value": "7c182c7c179ef939c1bbf1b82f042234", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632185517, "uuid": "c291e6d3-855e-4c93-94fd-51a75fe9d873", "comment": "Malware payload (AgentTesla)", "value": "438a50c5f70ae621fe841b4e374fb6ca497eea812ed0a12747ebcfa6112b0c31", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632185517, "uuid": "ab0a240d-7350-479b-931a-5049671d953a", "comment": "Malware payload (AgentTesla)", "value": "e30cb48bee474cc053774d289567b84a144884fd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632185517, "uuid": "61197bca-00ab-45cf-bb8f-96258f94d21c", "comment": "Malware payload (AgentTesla)", "value": "1c799814fd3968825b9e1337d12d815655bc4d4ee5ce01c3d8339c05ffad90851272577c7614a0a3f0b19d4697ffde48", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632185517, "uuid": "1b974f56-4fcf-414b-a193-8d966c843224", "value": "T16C5412300B38CD42E5548EF5AD5286F4232CAD03690AAA3B26C47D2E7FF2A57C456776", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632185517, "uuid": "7f3e1610-c552-496a-a826-78cdab056b52", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632185517, "uuid": "414bcd3b-f951-4f7a-918d-538ea9d42a19", "value": "6144:XPaibq3Sayn/D868VojFN4MMnC6WQY7Qz6icLbPY+EFWEMECK:/aioPynL85oP6LiLbBEQEC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632185517, "uuid": "58b50c6f-8869-44ad-ade0-245e6215e97b", "value": 300032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632185517, "uuid": "2712a6a0-bda2-47f4-b9b8-bcdecae72b8d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632185517, "uuid": "4dcf59d3-244d-46ae-aeb8-719055373553", "value": "DHL STATEMENT OF ACCOUNT - 3300315209_PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57ba9825-1aaa-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632207946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632207946, "uuid": "4ca82437-5260-424d-be2d-a6ae96d5da3b", "comment": "Malware payload (RaccoonStealer)", "value": "fee90c7d671cbadd53cec15d8802c210", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632207946, "uuid": "57dd3df0-b435-4cd5-89e9-9628a5b9ad1f", "comment": "Malware payload (RaccoonStealer)", "value": "44bc3362221be1888156d1a7d5c29490a2c449d6cabe6766ecb6878500562057", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632207946, "uuid": "22539f6f-d961-42f6-98ee-6132c185aab8", "comment": "Malware payload (RaccoonStealer)", "value": "b42209157f37cc849a1fb44db43ca57b96a39159", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632207946, "uuid": "d295db64-a15c-46aa-adef-5653979acb7a", "comment": "Malware payload (RaccoonStealer)", "value": "ffc8bc0bf78015ac2cf0e5586559bbbfec89f47e3bb24938e0c6c741500e6b164513f5c7b792d019aab6762477033e7e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632207946, "uuid": "770025e8-ba1f-40da-b218-76f127e7b887", "value": "T106B4012036F1CA72D4A741714724DAA46E76B8125970838B7B967B6EFF302D17B36307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632207946, "uuid": "bd2b325a-6451-4cf1-b80b-d214725dc97b", "value": "cc09957b6a7030319b5e28e26ed6a721", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632207946, "uuid": "4e25a6e7-4fc0-478f-b035-0e338851eac8", "value": "12288:ZComAOiioDcy29k7CgPR+3Hjj2XAluADBai:ZCo3OqSkWY+3DaQjDh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632207946, "uuid": "14703ec2-8354-4700-8a9e-ccff4af0afa6", "value": 509952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632207946, "uuid": "2d011e5c-f392-4e62-a471-77a0745e78f8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632207946, "uuid": "ad1630cb-069a-4fd8-98d1-25da65860b56", "value": "fee90c7d671cbadd53cec15d8802c210.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c49a2fb4-1ac4-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632219295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632219295, "uuid": "d8d0c5ca-d1ad-4b92-8be2-fdb52410eed8", "comment": "Malware payload", "value": "1711e2639457b9e8073fe74dcd76fba4", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632219295, "uuid": "dc02c74d-e1ca-4c3c-ade4-df81db871f0f", "comment": "Malware payload", "value": "46af0e30badc9dd1fa6e7dffbe62394b685d8f214af842b12a210499fc572909", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632219295, "uuid": "0bb7b62a-a8b0-4c33-8795-800f9b90bcf6", "comment": "Malware payload", "value": "3a24d2d2f460c67e771b61300f574016f042c454", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632219295, "uuid": "116fe5d7-b719-4310-a4ac-f1a0b0a67a8b", "comment": "Malware payload", "value": "b7bdba303a0d3e41e1972f49aae3ed0d1b7885de642eec9d0b3bc378b2d692e77f0aeb9ef70024ba682a54edcbcd07e4", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632219295, "uuid": "fee3e5db-01f5-40e6-8173-4f154581d200", "value": "T1E1E6335FE8026F48D226E85B0FDED6146CAB127E9FD6EF6770219483AFC0D46B12540B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632219295, "uuid": "7f5691eb-001d-4ff5-ab85-4842cc3bdff3", "value": "393216:YMIlHzbkcYWT+foygUBVSmBO1N+0jCYkY:YZ1/k4SwzUBQmeNXjCxY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632219295, "uuid": "812b2921-5b91-4403-b32b-5ee586d1f1e9", "value": 13923552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632219295, "uuid": "668b4f74-0998-417a-a9bf-6b86aa6c7ab1", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632219295, "uuid": "9aceeb6d-76fd-4724-8d4c-6fb7814cde38", "value": "Avira.OE.NativeCore.dll.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6f1d351-1ada-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632228802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632228802, "uuid": "5648920b-9b6f-402a-a4c6-3ab81523f7e9", "comment": "Malware payload", "value": "4a34426d3fdacbc53632b361baadd8f8", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632228802, "uuid": "607ed1b6-807e-48b3-832e-83df776158fb", "comment": "Malware payload", "value": "46c1c6577cd8eb7f5dacb8f71da27ef0a2d2f1b6ee744878b468ad51eaeb27e1", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632228802, "uuid": "a9b725b9-ecd7-4461-b318-230c51ff0eea", "comment": "Malware payload", "value": "82a6c48c59039a4eb500d0fe7ace041d683b5bd7", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632228802, "uuid": "35c5db5d-aa97-42b8-9353-cdb9585e9aa8", "comment": "Malware payload", "value": "1c5b1b8909a68a4988f0889b0df748f8ae9a24b22d3b1cefbbdb2113768f0de870ec24fccb72d3ed20f4d240c6c35a71", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632228802, "uuid": "27a0f6e4-ffdc-477c-9a2a-c065fab8f4d5", "value": "T1C085BFB876047DE66A7F536BDA96ACDD13B616329ACBA4CC8074B7C30563371EE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632228802, "uuid": "7f7dd24d-b266-4fe5-91be-74b6a7c49252", "value": "24576:bnniJv/W9GX9/en5v5kVlfKKyhkQogGWVzsNu1bOo+RWM0Tms0fmMKQP05l69p:k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632228802, "uuid": "5c2d285e-33e8-43b8-8baf-9453fcf3dd29", "value": 1831867, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632228802, "uuid": "cad3fe9c-52ee-45db-a9e4-6ae6d6a18ac0", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632228802, "uuid": "fed00cee-49ef-4e0b-8190-f3cbb09aa1b6", "value": "PAYMENT COPY.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "647e4d18-1ab5-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632212691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212691, "uuid": "83d5faa3-9cbe-4a77-b1ce-4291a57539ae", "comment": "Malware payload", "value": "6ced408bbdc3f21af9ab102fa6823522", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212691, "uuid": "bb8b70d8-7550-4414-802b-254138318e52", "comment": "Malware payload", "value": "47b29972906b1b9e5b69855d6fb634fcb40bed65f44987e4a75868576c8c8b51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212691, "uuid": "aaa8a75c-a5ab-4e29-bcd6-7edd767dd655", "comment": "Malware payload", "value": "f927aa535889b618488c129a406c0a2bd38da3d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212691, "uuid": "c41e6990-bb2c-4d9f-809f-7f97c3da3749", "comment": "Malware payload", "value": "0d60ca50feff57634fab94bac1f70bd71b7ee5af4c28c5c21747c32af1034b10cac1bb9d38db58ae4a767f9806ee11b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212691, "uuid": "d6ca9898-a92f-420a-b7b2-3590e6c3345f", "value": "T15D76F81785F273C7F22271B06157B8F304E16CF209D3A96172293F0EDDB96026B9B666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212691, "uuid": "122744f4-a31b-4799-90b7-7a6b2e7ec970", "value": "514c554c4eccf8b5d18d8453867113c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212691, "uuid": "fe01a40e-99d3-431a-ab6e-6a18a762ec14", "value": "6144:PFKiOzC8VEXAouuoSMSeXVgKEaRIVgraV8wYyjPC2TOjITsE9htl7mc4onhaw/BQ:PHkVE/oSimhaN7u0KgLwBxOAjaRzT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632212691, "uuid": "7dc98b78-f196-439e-aeab-02acbb6b5225", "value": 7340942, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632212691, "uuid": "d0e80278-440f-425f-b12c-7fa8252683ce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212691, "uuid": "b0625624-cb76-4cc0-8de3-632e0473e9ae", "value": "47b29972906b1b9e5b69855d6fb634fcb40bed65f44987e4a75868576c8c8b51", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f440324-1ae5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632233352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632233352, "uuid": "b013ed1e-2602-4542-ae1a-42ca9fdb8c36", "comment": "Malware payload (Dridex)", "value": "a21a285ce9482d0a0a45f4f33063c608", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632233352, "uuid": "008dd4c3-2fdc-490a-9a27-f2abb49a6d1b", "comment": "Malware payload (Dridex)", "value": "47ce31756f024d900bc4dbfb7c7c3c5ff6ef1ae93e99a7ec1e2467253297cefb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632233352, "uuid": "97f12bfd-b06b-4cef-8b5a-7b521ddd0284", "comment": "Malware payload (Dridex)", "value": "8d519eb98ddda64f7733a3251d1d14d13dde54eb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632233352, "uuid": "ba954b6a-d156-4710-ae3e-a34b64c9499c", "comment": "Malware payload (Dridex)", "value": "172f7b11e3fb2f75da4be5df7cb9196a2950866928dd7477593db534741b155b73de498402f8fa46b952db9c72886803", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632233352, "uuid": "2bb8ac94-df97-4af1-bbdf-ea845121bb86", "value": "T1C715F10376FC9E76C1AE073518379B718AB6BC222674E20F57D03D8E39767E24952722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632233352, "uuid": "3240b124-e59b-4b11-b764-dfe612b44546", "value": "e19687a825dd60507df2609a0c86c4ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632233352, "uuid": "b223f0eb-3a8f-4411-87d7-87b6c7b371f4", "value": "6144:CK6cyPiWCgknQ/HuyIzuTVzsMM56519p+6yTDy1GeS3KmJBC0+eekTdFyDPckaS:CM+ZdkmHubeaCo6r1GeSTjvODPL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632233352, "uuid": "4d2974d9-a362-4557-881c-f28ab4b4169a", "value": 920576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632233352, "uuid": "cac27cd7-8401-4235-a215-2f55cedcbf2e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632233352, "uuid": "9c50c695-e780-4be0-b630-f26a486a43a2", "value": "a21a285ce9482d0a0a45f4f33063c608.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff71c0a6-1aa2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632204791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632204791, "uuid": "015b17a0-f720-4302-9962-6bf4caa3f067", "comment": "Malware payload (AgentTesla)", "value": "474d8816bffa0c07a9d2694255c65ce0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632204791, "uuid": "1782b576-8acf-478a-ad45-5865d5dbf9f4", "comment": "Malware payload (AgentTesla)", "value": "48436abd3dea15e95afd8f9464d1d72249369f09b3d4b721a75b68431e602de5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632204791, "uuid": "41bd2092-be33-4227-a8cb-33f89430e8a0", "comment": "Malware payload (AgentTesla)", "value": "3d14326d2a57d408c2cf6182bafe72f93bc1c952", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632204791, "uuid": "13dc2be2-233f-4daa-9285-6bf24de0dadb", "comment": "Malware payload (AgentTesla)", "value": "0bb70e19606102d53424ab0d748ee786e6279423b208bb54f2f4dc37dd0c51a4b188487fc47c2b0c3864172a3daa9876", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632204791, "uuid": "1f17761c-a7c7-47e1-b276-5e3e8f5039ef", "value": "T177D4F13850D70FFBC5DA453B2871B8E60AAF9F101D14E2DD11BEBE62EAF02D85325946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632204791, "uuid": "d3b3768a-42d4-458c-96b1-6cfd6fe5c7d7", "value": "12288:Z5sFObbew01ibzjQboHwwwrc/km8p0FfKfRx/Ksx68FexEy0JwwwwwwKwwyJoD2D:Zbe7qvQboHwwwCkm8pqfKfX/lTFexEF3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632204791, "uuid": "9b0e7b41-4e08-40b2-b165-5e3860038c3f", "value": 610504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632204791, "uuid": "9d3f3149-1bdb-4ccb-a5d1-4dcd423bdf07", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632204791, "uuid": "6c429ac8-8d63-4f2f-b258-faee59b134c9", "value": "NEW ORDER- PROJECTS.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c77ac92-1ab6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632213027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213027, "uuid": "eabf22dd-4295-45ed-a4af-d9efeacf2f23", "comment": "Malware payload (Dridex)", "value": "6ed84d58a9c977daf8af2e6d0b3545be", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213027, "uuid": "2a48f851-5b57-4cec-9128-508261f479fc", "comment": "Malware payload (Dridex)", "value": "4968f1993eac7b92973140a31f8405342e63f318a7eae7f8ab5d65ce78efc3c7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213027, "uuid": "6efe367d-bb62-4c35-8963-a708fe70e7f4", "comment": "Malware payload (Dridex)", "value": "a8addb01a34991be312921c9b80f2024b02a0a9e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213027, "uuid": "8827302a-31d5-4423-be4c-f1610ccc9b00", "comment": "Malware payload (Dridex)", "value": "afb47582d9794a635f7836b119f0b68e7eff43fe688b676f67e158d9f0f0aa7a4ff553384ba16df91fed032254d3039b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213027, "uuid": "9803034e-e5c2-476f-be98-f8033cde3203", "value": "T135A5E020EF69E1E6C6B89F3E9408352727F93D75110D608CC392604F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213027, "uuid": "c948697e-00ad-4091-af59-b8c7010bc468", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213027, "uuid": "36af24ba-1072-443d-a35d-74031d352d58", "value": "12288:/VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:2fP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632213027, "uuid": "b2ae698e-e2dd-43b9-aef8-88be4039da53", "value": 2207744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632213027, "uuid": "246e1b7b-5a5d-48d5-afc1-0df5a9401bae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213027, "uuid": "301f9d52-cc7b-4c18-b677-a694513ee2e2", "value": "4968f1993eac7b92973140a31f8405342e63f318a7eae7f8ab5d65ce78efc3c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec6f9c73-1ab6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1632213349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213349, "uuid": "023ef855-3bed-4ebd-afa6-759ada107dce", "comment": "Malware payload (NanoCore)", "value": "58a730c2a7d23b4557f80bb3c8163d44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213349, "uuid": "b0c5994a-d851-400c-b64f-1a3375466ccf", "comment": "Malware payload (NanoCore)", "value": "49bd6bf70aa0cbe11391eb8a9d9e21ee209b0bd832d5e6ba234b7b75fe2d5786", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213349, "uuid": "abbc8a92-1a8f-4f1f-a237-8471d69e3833", "comment": "Malware payload (NanoCore)", "value": "c27c13cf55e0d3413e66fac667c64374ece0185e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213349, "uuid": "e5c2ce3d-3d15-4a7e-adc8-817491f22eb0", "comment": "Malware payload (NanoCore)", "value": "505500c6a59c57ffc53244b94149909b84c3e8584c40f9ff1e46a82eba999e110a95a3e1ce6a52dd8c57ecdb9683ba4c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213349, "uuid": "d82b3831-330e-4eee-8669-105a7a6492d0", "value": "T1509448CAAE5968FCF605F63FABABC47C1FD2AC5054F85E5E22CCF11F4860D42115A862", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213349, "uuid": "18e7609c-1d93-4155-ae72-f7b6fbfbe7db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213349, "uuid": "f71202e5-5816-4a3c-9f01-cb780aaa9cec", "value": "12288:01wZ/RqZM6+3at6yApbQhZ66z24VZbdCpgrPN2LWzmidN:01wXqZM6btFApbaZ66z24VZbwpgx2LWr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632213349, "uuid": "b549cfc5-97be-4ea7-99d4-532475121056", "value": 440320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632213349, "uuid": "a8bc51f7-b6d3-4060-9a8f-d79470dca291", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213349, "uuid": "d7331db3-1d83-4c53-9ccf-14dacdb9218c", "value": "49bd6bf70aa0cbe11391eb8a9d9e21ee209b0bd832d5e6ba234b7b75fe2d5786", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0db75ed-1ade-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632230536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632230536, "uuid": "583feef8-3d99-4f0a-8061-624539f08b34", "comment": "Malware payload (RaccoonStealer)", "value": "bd53a54ad146c5e6f8510c842f6434b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632230536, "uuid": "9d97ec20-bebe-403d-bc55-00eccc134053", "comment": "Malware payload (RaccoonStealer)", "value": "4a1a1c30c4af89809f10fee23f239f2c591efd4fbd80e55a016c4cc88b762c71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632230536, "uuid": "62e88778-cbe7-465a-a5d0-85cd876bb5dd", "comment": "Malware payload (RaccoonStealer)", "value": "dd82d21c9923c3e10a2b51cd5e8a00a1a5f9a33d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632230536, "uuid": "3f84b8fa-bb7d-4452-890f-0e73ed5b07b1", "comment": "Malware payload (RaccoonStealer)", "value": "7e055b7c9f1f2a7720718717d646aa083b6815e561073881bb8f071543137293984b1833a367523134da3b1e2477eeea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632230536, "uuid": "985ed15b-0b6e-4b50-a146-ba0589f932cc", "value": "T114B401517562C773D09384300B31EBB05A6ABC63A971834B376A7A7EEF743907329356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632230536, "uuid": "71f34d01-a6b5-4f5d-9b19-1daeddaa0339", "value": "019bced73b51911db702af2d47c34cb7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632230536, "uuid": "6ae4c5d7-a560-4f6b-9f28-b37ac0fdb5aa", "value": "12288:KB5Tpc7khgyHxLAiRn6SpVNiwsYrhxaNkAzU2Bai:iTpLiyHJ8SpVNiwXr+bI2h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632230536, "uuid": "8032bd82-0ba2-4c00-9909-e22f6248191c", "value": 496640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632230536, "uuid": "b2319590-2811-44fa-8e48-75aadbdfa4c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632230536, "uuid": "a7d3bfe4-b899-42c2-b463-c0da5a1d93dc", "value": "bd53a54ad146c5e6f8510c842f6434b1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6eee28b-1ae0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632231271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231271, "uuid": "a4bb05d9-27f2-4505-8531-ad03903998ac", "comment": "Malware payload (RedLineStealer)", "value": "7e87dbce09eb5f6a7009c19d76d8fadc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231271, "uuid": "7d23bd0b-f1da-4534-9915-0e0d5f9c6107", "comment": "Malware payload (RedLineStealer)", "value": "4a1eb5d077f5f4134acde43b07cda42bc1f03570bfcdba0289ef2af4212d0bf5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231271, "uuid": "f1b3c1fb-538f-4c56-b2b5-871d75bc1150", "comment": "Malware payload (RedLineStealer)", "value": "459713a5aa589feac6942bfd61cb64a80e17f446", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231271, "uuid": "f90876cf-bdbd-4371-a7e7-95a938ac63a2", "comment": "Malware payload (RedLineStealer)", "value": "1a0e2736d008d03a7eec3ea8919dab58b2acc853e7c59d41a2f70e5f8576f37f4eed8244f05b3f083fe386699f93ccc8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231271, "uuid": "59f9a1f1-4414-457a-8e8c-308ca464c476", "value": "T17264E0017AA0CE73C4934A714B65DBA46676BDB1AC218347AB563B6FFF303C17626309", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231271, "uuid": "b81affda-8700-4e98-be5c-1c38fc4b4dc8", "value": "cc09957b6a7030319b5e28e26ed6a721", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231271, "uuid": "20779e28-a1ad-467e-bb7f-db0eff3e995b", "value": "6144:MVTs9f3ZHyLJ0VTfjB7WuXww62W3lATfz3gO2MEi+Bwjtw:KTsxI8fjBjXz62W1ALcbMEi+Bai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632231271, "uuid": "39879962-8b88-466e-9cd9-4c19cd3fcdaa", "value": 325120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632231271, "uuid": "4f74565c-62c7-4f11-82ae-040695280467", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231271, "uuid": "a6a70802-330a-45f2-bd47-f7d58c1df158", "value": "7e87dbce09eb5f6a7009c19d76d8fadc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eadbedb-1ae9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Hancitor)", "timestamp": 1632235042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632235042, "uuid": "4db0f267-01f9-47c2-9c7e-57d807f00f20", "comment": "Malware payload (Hancitor)", "value": "79e1396b610fcf4eb089a33da56f12c9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632235042, "uuid": "17dca25c-0211-43b7-9e0c-248868821859", "comment": "Malware payload (Hancitor)", "value": "4d215d88296651afc1c841323f0fe3d2b9b3302684eeec82ee23f6c2464b5601", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632235042, "uuid": "7d9f94de-9727-4ebd-8d9e-a6dc84da6785", "comment": "Malware payload (Hancitor)", "value": "e502e37ac85d7e50839b050780665bdb8eb558ed", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632235042, "uuid": "4a5c6d1f-96ce-4809-8cb9-063b62578578", "comment": "Malware payload (Hancitor)", "value": "9056d48509f8da39f60924a5782f8e59ea89e6b4e31a5e835e435690f00984eed2b300b6a4a86fd87189d424519f237d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632235042, "uuid": "ac961118-daec-4c53-8899-cc86805850f2", "value": "T17F14AE167EC3D4B1DC3E0E3848B1C8E167393816DB549A6777A43F3E0EA30C26D6599A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632235042, "uuid": "18cc83ab-2692-4ae4-965b-0b33075a5496", "value": "7b4bcb8f0e870f1b227471cc8d5e496b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632235042, "uuid": "534bd87e-5632-4180-8bea-185ab23a135c", "value": "3072:x+3/NF1Bs9MJTHNXxjxYqybz3nh9qIhspznfH779NNj/vOWQplllll/lllllqzI0:43lF1Bs92tliv/HotP97qlllll/llllS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632235042, "uuid": "4f727b4e-5d0b-4faa-867e-6099578fc352", "value": 194048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632235042, "uuid": "080287a6-ef3b-4009-a3db-ea0271e10b85", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632235042, "uuid": "6b8f804b-fef1-4d9c-bca8-277610705b19", "value": "flex.xz.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "606fb9ac-1ae8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Quakbot)", "timestamp": 1632234589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632234589, "uuid": "3e0b76fd-5ec5-4d54-ad04-805493375058", "comment": "Malware payload (Quakbot)", "value": "7f0b9d11c95a65e9e9f87b2341bb01ad", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632234589, "uuid": "0213c012-58c8-48cd-8571-c8a99e0b15be", "comment": "Malware payload (Quakbot)", "value": "4d3095c7965c7bdd32b81b72c95f767134915cf08ebe1237721ed5208de4beee", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632234589, "uuid": "2356b92c-74a7-4b28-9ac7-d97ca99a7c6f", "comment": "Malware payload (Quakbot)", "value": "93abbf5758c39672d69502690b5e4003a47f9e72", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632234589, "uuid": "048993ce-6af3-4f2c-b76a-86577ce04df7", "comment": "Malware payload (Quakbot)", "value": "517afb2652050d8fcfe0c088bc9646ec9300e4dd78d669e940aba323eef741f180ddcd77b8a86c4a08827d7bbfc6ee75", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632234589, "uuid": "b02a4b18-c69d-47db-98f8-1decbb2c97b4", "value": "T14BB49F22F6D04437C2A3267C7C5B56689839BE403F296C4B2BE81E4E4F797813E65397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632234589, "uuid": "c0f621ec-258c-447a-a46d-65d3a7215dd8", "value": "e2d1256164a0caaa5ac6b37088580cc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632234589, "uuid": "706bab0c-0473-49ff-bf90-0587ac6fa057", "value": "12288:H3kLeTdBwPJNwtO0s3pg13iZUnzLQGLnHhTBRf4KAm9V:XQowRN90SeyZrGLnHhtRfDVv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632234589, "uuid": "2054d07e-5c32-4692-8e53-7ec047041f39", "value": 500224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632234589, "uuid": "5c456d60-320c-45fb-aad8-49efb4e7b0aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632234589, "uuid": "ea8d90c1-eedf-419c-9cf5-2c5e0113e377", "value": "44460.6828835648.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1ffd0ef-1ab5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632212875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212875, "uuid": "dd26cc37-d6f2-4792-86c2-039c483b5b41", "comment": "Malware payload (Dridex)", "value": "6943214ce2357ed8df3fadb44033cab9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212875, "uuid": "65ef38db-a799-454a-bd5d-a80b25e5b4a3", "comment": "Malware payload (Dridex)", "value": "4dd0d0e575cdc609d92cb5ca3ad1311c8f6647d7b871fc83e54a8481311b20c2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212875, "uuid": "73741ea0-e3c3-4696-ae22-1f80e400adc6", "comment": "Malware payload (Dridex)", "value": "d74447c277b070973a0ae534424e5413224af662", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212875, "uuid": "1debd91e-defb-4f58-9b45-e6a09fcb6317", "comment": "Malware payload (Dridex)", "value": "6ed1c358c89af790dae61d0b89f601b61691e1c71e7e6fbe3510becaf68b4442557996d42bac9c7d3f01e7ffd348ea13", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212875, "uuid": "70c07673-4b2b-4c53-b8d4-a14f2b5594eb", "value": "T1D9D5E020EF69E1E6C6B89F3ED408352727B93D75110D618CC392604F5EF82546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212875, "uuid": "65aad17e-9a31-4e95-858e-0a1cd03cb6e7", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212875, "uuid": "b5ab5356-cffb-40f2-a1e0-2957bf478f4f", "value": "12288:jVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1G:yfP7fWsK5z9A+WGAW+V5SB6Ct4bnbG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632212875, "uuid": "bbbe3c54-ce38-4e2c-8afe-522169940c51", "value": 2834432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632212875, "uuid": "23b07c57-be1b-410c-aba6-ad4541e840f8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212875, "uuid": "627e3152-87e5-40d0-b9a0-512d34f482c4", "value": "4dd0d0e575cdc609d92cb5ca3ad1311c8f6647d7b871fc83e54a8481311b20c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82cf4019-1acd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SilentBuilder)", "timestamp": 1632223050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632223050, "uuid": "e19a32e5-363a-4a92-bde1-40b804976290", "comment": "Malware payload (SilentBuilder)", "value": "6518803b1e79d902d5b251d7db9981bc", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632223050, "uuid": "af44d35c-be29-4628-9ed3-16c8b6e7175f", "comment": "Malware payload (SilentBuilder)", "value": "4dd36b16e1cda615961336d8c8fc555d0fc95936ef5f8ba66b4b2ab12d5a23d9", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632223050, "uuid": "682fb0bc-88db-4a5b-b3df-fc25c5fdd380", "comment": "Malware payload (SilentBuilder)", "value": "ae42cc090d7b82e53df1b0b6ea9552279e13d840", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632223050, "uuid": "05419443-da14-41aa-b03b-bd9bf8f13925", "comment": "Malware payload (SilentBuilder)", "value": "b3b6d71a86a2a7b336a564ef0ea6d930e71c1596c4b10f386ea4aadc1cc661997484110b1c2f0a8d9b385eb57776bf79", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632223050, "uuid": "1f363888-14f7-4f87-a32f-e293fa360c55", "value": "T10544D02676A1641EEC2D2B76A4BB53E02337FC404FD38BC76AA772223F729D14D26505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632223050, "uuid": "50ee3a7b-6de1-4d63-b2f9-783a845e1c62", "value": "6144:jKpb8rGYrMPe3q7Q0XV5xtuE8vG8UM+RnfzLI6+tqD2EwnoR57lj+QSGxGvJmmma:kbD6qyEwoR5lTS/cJ3nLw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632223050, "uuid": "02bd2b36-b772-4c26-8281-542bb0e89f32", "value": 270336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632223050, "uuid": "dde84afe-d6fb-4548-b79a-abeddc791235", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632223050, "uuid": "22f327c3-f372-4306-bbcf-165efa6590d3", "value": "chart-1896160650.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce9acbdd-1abc-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1632215876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632215876, "uuid": "2035cd59-0a49-44d1-8532-5327100b77db", "comment": "Malware payload (AveMariaRAT)", "value": "ae032615d018c1ac2eaf09bc4c340fc4", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632215876, "uuid": "955447f8-e19f-4656-8664-fd48c4de4311", "comment": "Malware payload (AveMariaRAT)", "value": "4f545eb8ba5c677124256edb92f504d8d3a408d8cc4b08953ae72b2c02d11597", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632215876, "uuid": "7844e0a9-8789-4a90-b69c-1f0701720bad", "comment": "Malware payload (AveMariaRAT)", "value": "2101f2f250015e405df3c944d3d40ae8f8d8985a", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632215876, "uuid": "ef825527-2dad-4eca-9b21-88e6ea8bb8b1", "comment": "Malware payload (AveMariaRAT)", "value": "aac0325a607a638ee7f045c9e40f2d6266a0030cee6bf346cdcb4f6a61a79cf6546912d47ab02abc0f08fd69d35e3a71", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632215876, "uuid": "e5d22ed9-3cff-4739-b9f7-76e2797207c3", "value": "T1EB1589294D2682F7C3EEC63CD08C1FCEDAA2A4977B918F1AD491E783125774BE49845C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632215876, "uuid": "3563667f-df80-4680-a9f3-8b72fbd13694", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632215876, "uuid": "a95937db-c433-48c8-b4b5-3c2e23b45c9e", "value": "6144:HJWT27GM/mV8C1icpLVO74/xVRMmHQ5zmQH9M3C4B6pXQmd8igLCl/Tgdg:p1/qweL7x0et29M3fWXSitlcd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632215876, "uuid": "e05b6fca-a577-4df5-8ff9-5010d157bfbe", "value": 940032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632215876, "uuid": "dafbd80e-6b96-4412-931a-e68d8c775f85", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632215876, "uuid": "04b90cb0-236e-47e7-8e01-4296f6e5efda", "value": "order -20210921.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "780d6aeb-1ab6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632213154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213154, "uuid": "5648bb8a-8f10-4a7f-8f96-e2e4a5e1877c", "comment": "Malware payload (Dridex)", "value": "3e646cfd0722ea503289ce7130c809db", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213154, "uuid": "cc4a05b2-5be3-44a2-a119-129cb9028a74", "comment": "Malware payload (Dridex)", "value": "5124e192db2450a20cee454e93af1afc35e9c3738d20d1a8e5a6e812536c36db", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213154, "uuid": "fa75ccb2-33f3-4318-8b7d-9f3e08d369fa", "comment": "Malware payload (Dridex)", "value": "6cda448e90ba05d3afc277ad0e8bf5ab215272ee", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213154, "uuid": "74aa41db-6c68-4503-bed4-4f9faa9878cc", "comment": "Malware payload (Dridex)", "value": "ab529fbdd19a82c401eac28e3f35535b9bef8431139ceaa03028676ebdb60019c7e855b9b8a1b5226d70b5d106a8f8a2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213154, "uuid": "3145d4c4-d135-4a1c-afe0-fefe20d8cfbe", "value": "T18385E020EE69E1E6C6B89F3ED408352727F93D75110D608CC392604F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213154, "uuid": "63ca7536-f1c3-42f5-bc14-6bcb78e1c268", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213154, "uuid": "bf0a8a31-fc9a-4227-a266-39dfc3564963", "value": "12288:IVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:dfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632213154, "uuid": "73207ecc-ec00-4837-bf8a-5440eac0fc49", "value": 1761280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632213154, "uuid": "e447098e-2080-4b2f-b355-4c222e08beec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213154, "uuid": "0f973105-8316-463b-80ce-c660d0d6deb1", "value": "5124e192db2450a20cee454e93af1afc35e9c3738d20d1a8e5a6e812536c36db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ab14537-1b04-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632246605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632246605, "uuid": "9107e167-1b36-43f9-93b9-db716235aeb3", "comment": "Malware payload (Mirai)", "value": "61867efde38948ebf9ad4f76b123c452", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632246605, "uuid": "49a99fbc-86ef-4200-ac8a-6e1618552104", "comment": "Malware payload (Mirai)", "value": "534ea7beac908008f266ef4bfe66510a306cd71894f6b30d8698a0508dbdec8a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632246605, "uuid": "b1cfd7f3-1327-4e08-925a-5e0c8546c2ea", "comment": "Malware payload (Mirai)", "value": "c3c6c09b3e12621a213e821a4337c334d5c471b9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632246605, "uuid": "7f19cdf2-82d0-4555-9f6f-68ab407df5e3", "comment": "Malware payload (Mirai)", "value": "19158a68a4d8c6cee29355e57936e1e68e2d985b329d504b50094deca4a0497e0f95d80f5a7ab8e5845ffcbc669569fc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632246605, "uuid": "dc2fe53b-d039-4792-9f9f-55992cb4e275", "value": "T12FD2E0D81846AD50D1A004FD394C87759B5B82A4F3EBFF220018C7EDBFC657685B4AEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632246605, "uuid": "f0df7199-fc4e-4f1a-a4c0-a714c87a4bef", "value": "768:xDrVHM1oPmDS+8NWMULVBBS4QpZVGNnbs3Uozb:JBHD+GqSf/0NnGzb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632246605, "uuid": "4f0cf93f-8802-4015-ad4f-4ea6f5f57463", "value": 29424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632246605, "uuid": "3db2c745-00c1-45f4-bab9-ca03a20803fe", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632246605, "uuid": "95edb0e6-c7bb-4b15-bdcf-7cc8dbe896d4", "value": "dark.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d30448bf-1a8b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632194838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632194838, "uuid": "0ca11750-b388-46e0-a5e8-fad3f01525d8", "comment": "Malware payload (AgentTesla)", "value": "ff8eea134983679fa8333adb2e7196fc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632194838, "uuid": "537bbd63-5cbd-4bdd-8a9f-ed50fc4eb335", "comment": "Malware payload (AgentTesla)", "value": "53c6821fb29a31f313be339bff2f88b1aedb0c670c25818d06ff6f1bdfbc019e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632194838, "uuid": "dc54d7af-dc29-4f92-a57a-5f8be42e39a2", "comment": "Malware payload (AgentTesla)", "value": "e8270f1688aa35c715c9d900d50f2f45db09e286", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632194838, "uuid": "65b2ac2c-87dd-4ce6-8d5d-d76876d23d56", "comment": "Malware payload (AgentTesla)", "value": "ae1f0c6d263a20d7ef4116b088badf5a4be518e2b646ff15e9aa389d0217edd07e53435664c360efc53a2176e7597135", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632194838, "uuid": "ef4e7716-14f5-4bfe-906f-3217dd223c3c", "value": "T1E035E0398D9682F7C7EEC27CD89C2BCEDE6594933B514F4AD991D7C2026760BE0A844C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632194838, "uuid": "672e118c-4b68-4419-8ed1-5dec0ced55a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632194838, "uuid": "f631c847-0c85-4e21-92a9-7c18db37ee1d", "value": "12288:cenfxeAPUUtI8V3cWweZ/RQrNhtPE9PB:hfy2JUiK5MP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632194838, "uuid": "9843c44c-29d6-4ee7-8b93-86f6e7c18588", "value": 1077760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632194838, "uuid": "9e443eef-7817-4cde-a62c-dab469a6531b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632194838, "uuid": "56443aea-a112-4e57-8baa-b0ec9e22bc8a", "value": "EQdwImyIu6S14EI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a8befd5-1ab5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632212728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212728, "uuid": "307bccc3-5951-4e8e-bcd2-86f0c9641db0", "comment": "Malware payload (AgentTesla)", "value": "e6088d478b2297fd274f13a8ecbc2ff8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212728, "uuid": "307ec679-2c0a-4cac-9453-abc383cd09ec", "comment": "Malware payload (AgentTesla)", "value": "53eec0c5b96ad1bc45e9a82e729d06b100cb496f6824364903ec39b0e57c1ff6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212728, "uuid": "16965226-41bc-4f7d-8a80-167c86920655", "comment": "Malware payload (AgentTesla)", "value": "7451a94fd176f18dfa9ce3c2cd79fc5d8f15e02e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212728, "uuid": "9a68483e-dae4-4234-9687-fa1731320b2d", "comment": "Malware payload (AgentTesla)", "value": "e9f867c8140d5ba71752a309f4d906bbd110df8589fec7ad5b06c413458edeb41fce7ff893366513198d186bd98d9060", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212728, "uuid": "60fdb37b-139a-4332-80dc-c495ca8b8a9c", "value": "T12D059EC17D47D89BF0DF2AB388AFC42012656E8D5161C73D26967A2B54F335230ABE4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212728, "uuid": "ccbf277a-81c4-428f-84fc-97f3a622e35a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212728, "uuid": "c810eba0-4080-4ad3-80ae-c24e0d8ff556", "value": "12288:V/7WQW3z9m7smtiK5oUZ7DLp1rAl8OD1IxAPa5zvrLNc8kf6LSGQK:t7WQ++FoED11rw7D1EAPa5zvfNSZZK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632212728, "uuid": "3890807c-ca7d-4406-ba65-e896392a01a2", "value": 837120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632212728, "uuid": "236c7490-fe81-4857-b6db-4b8aa8489865", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212728, "uuid": "8d69a737-66fa-4f92-a89d-db1d165a09cc", "value": "e6088d478b2297fd274f13a8ecbc2ff8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc3054f0-1aa9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Hydra)", "timestamp": 1632207792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632207792, "uuid": "00477e3b-a9fb-498e-8ef2-fcf3fc3145a8", "comment": "Malware payload (Hydra)", "value": "c47cdae511e1dad0328abdfdbe60bdc3", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632207792, "uuid": "0006dbec-f073-47c3-8194-12770862374a", "comment": "Malware payload (Hydra)", "value": "54318a908bc0d347fb56fe48ff7ca7e16fe5eec1d69e7248c902eac0edd45a5b", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632207792, "uuid": "8cc4d232-76e0-4bf4-8ac8-74e52377fd50", "comment": "Malware payload (Hydra)", "value": "cd9c039963cc6ad28677041d5096fc6098cd6e27", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632207792, "uuid": "ae2352d1-d380-4b4e-9207-3422f2932069", "comment": "Malware payload (Hydra)", "value": "637d579671b0b1db60ba31fb193ec871409ab8d27acbbfa344edec1ce3a73e47d8a8ffecb1b8c37eae9bcf2069c498dc", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632207792, "uuid": "835a323f-f141-4c7a-b41a-2cfea1d7e9cc", "value": "T1838633FDB3C1DB82E77E267603D796817E920E6156C2D03791987E8048B6C8F2D52C9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632207792, "uuid": "63ce9cc7-0063-4b36-82ac-e9f92290ac90", "value": "196608:S8CarJhoQCOo1DWx0RiQdyjynFAL98HcR5PD9f6zcdtr3v:S8N1hoQClJWabyj40icR1JCzkLv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632207792, "uuid": "9efa27ee-e4e0-466e-b6f6-71287a948cf1", "value": 8213339, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632207792, "uuid": "e9e5dc30-ec59-4864-bec0-63693560a2cf", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632207792, "uuid": "b2855a49-b2b2-401a-a639-7180ba3bd5cd", "value": "commerzbank.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd0011b8-1b17-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632254984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632254984, "uuid": "d8a1a376-48fc-4e80-9585-c192a136546d", "comment": "Malware payload (RedLineStealer)", "value": "32b7ab30d58602ab6e287f8c3982d561", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632254984, "uuid": "cd4c2f23-4be1-4f33-97ad-78c4faeda8f1", "comment": "Malware payload (RedLineStealer)", "value": "55415e508d283bfd58795c2f0d4455c43ac03fca354c007fd8cd46a756bf342c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632254984, "uuid": "03a8d439-0753-4e92-b14d-92421884bd6c", "comment": "Malware payload (RedLineStealer)", "value": "ca1f45f892616501276b450375033a45c3057b2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632254984, "uuid": "197d5b82-2714-4228-93a8-7cc4300d4ed9", "comment": "Malware payload (RedLineStealer)", "value": "69c1db1dc8487057e7741d691e168ec7f866a57312f46b217b1abf1af47cf02deea85cd3ab8682ef508b04d19ed7b62b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632254984, "uuid": "c9f3892f-50d9-41d7-b499-3a3b53a63f47", "value": "T16164E10077A0CA32C56715328B23E7E16EBBB82369609377B767366EEF30291B711355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632254984, "uuid": "54b0d301-6b8e-4cde-8fa1-863ef813d890", "value": "98349bc8fa025f57a9d49df3092c15be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632254984, "uuid": "ca136604-09f5-4e65-b3ae-3df3bc4c91fb", "value": "6144:LywBpOezjE8Nlf0cZw3p27qhrxN/bEATRWBwjtw:GwBp9Y8NlfBqLrHoA0Bai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632254984, "uuid": "ed66e4ba-5d1e-4c6e-9836-12bf16858136", "value": 312320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632254984, "uuid": "6af447a2-cc4a-49c5-abe9-4d678136ad7b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632254984, "uuid": "aec9e951-189d-41bd-8039-1fd4eff45029", "value": "SecuriteInfo.com.Trojan.Win32.Save.a.6795.9891", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "974bf1e5-1af4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Squirrelwaffle)", "timestamp": 1632239835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632239835, "uuid": "2ba1e535-3f9a-4f31-9ec7-1aa23a364288", "comment": "Malware payload (Squirrelwaffle)", "value": "6373e3b1950d7529d63262ebc9c76ea9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632239835, "uuid": "f74475e0-5032-4865-88c8-03611c0d48dc", "comment": "Malware payload (Squirrelwaffle)", "value": "5582447866948a38cb3d1013759854142cbbdc812de3d821c5d4c151e4ebbe6f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632239835, "uuid": "d4776d6a-e0e5-4c63-a032-df826f2c2b07", "comment": "Malware payload (Squirrelwaffle)", "value": "4a1e34488f21c336599dc7b576bdfda066f98522", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632239835, "uuid": "75d887e5-e759-4b28-896b-35b0ccb67e51", "comment": "Malware payload (Squirrelwaffle)", "value": "602d19a49742820c95fa1d7912e12873d4e4111a3e5b42aaaebd95ba075bee8cd2e3c8dc71dac9a599a246471a55fe53", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632239835, "uuid": "6dcf9100-5d77-4224-838e-6708aa9009d0", "value": "T1464419B8BF92CD54E0594AF482B28F60CE6657483D25CCDB92F9E9EC5A797C0780B143", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632239835, "uuid": "5ee5d28a-6d8b-47ad-805c-9e869ab5d2ff", "value": "6ab39574820a2a48b54bd7f4c3fe61dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632239835, "uuid": "a35136ea-c05e-483c-a2e3-9a75941ea967", "value": "1536:tK4+iZammcvDYpYV8ZQ0BPeLcYFS5ZocmBh1ljiZKlBXTTEHs2nlWUU5B+opdTmk:immADHV8Zh1ekCl1lhBUBp1QKHKH9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632239835, "uuid": "c7ed7209-4456-4fec-83eb-9c625d6dc36f", "value": 266752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632239835, "uuid": "21533891-c286-4650-87eb-9e3aa7a45565", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632239835, "uuid": "ce50fd21-b884-49ce-aa60-dd46bef36517", "value": "5582447866948a38cb3d1013759854142cbbdc812de3d821c5d4c151e4ebbe6f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10491cde-1aa3-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632204819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632204819, "uuid": "62f23e8c-0951-42bb-8768-02f633293db8", "comment": "Malware payload", "value": "298b36a28f31bcc329ecfb6b9ae2520d", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632204819, "uuid": "7a2c2ee2-5449-45a0-ba4b-b872a398eb07", "comment": "Malware payload", "value": "56068e08d5528003b1fb3fb24eda6feb578ceeffb363b7028ffeb74f677975f1", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632204819, "uuid": "bdd73623-88c4-409a-8915-b4e6a483611d", "comment": "Malware payload", "value": "d5681b381576cfb6c55505c2ae65e9717f378228", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632204819, "uuid": "84b5ae95-d06d-4f25-8f96-c9f53ded60f0", "comment": "Malware payload", "value": "4119da77326d0541895cf5efd5befdfa63484e4c4894472825b0833f6f288940dc6e6c9aa6d0856ab61cf71dc2df8711", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632204819, "uuid": "47277b33-1cdc-4edb-8ac9-67ab60845e7d", "value": "T1C074F6E433D2CA27D5CE0A33BE42A7E5857AEC6591C1A10B82987B8C1CFC643D5B6DD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632204819, "uuid": "fd75b3d8-dd9b-480e-a883-f4a27ba1e811", "value": "3072:Z3ygYXkj7q0vTYDryOsnLlU6ij4qpXqnnDibAJBVk6YYA69d3DWPcQUuBq:Z5ialTqp4nwEzYYAQ3DWPcQU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632204819, "uuid": "115da8e7-4c50-4069-98e2-750abcdc3683", "value": 351232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632204819, "uuid": "7626006c-cbc2-47d1-aeaf-cc1463945534", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632204819, "uuid": "59335043-a4a5-4186-ae6b-f31a5f2f442e", "value": "Correos_Pedido-HSUEL43H2SN0Q1W.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "855eae60-1b2d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632264286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632264286, "uuid": "21400e97-eba9-4b2e-877c-f6affa3a1044", "comment": "Malware payload (AgentTesla)", "value": "86c5f6685d260b5463696c888926270e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632264286, "uuid": "686d6e51-11b9-472e-8cfe-dd4b3056b40c", "comment": "Malware payload (AgentTesla)", "value": "566dde49e089336c392a473425f2b98c3f4e247f06877670eb1b6b2a99ae3c93", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632264286, "uuid": "124c6010-0476-4b93-9184-027d17712a38", "comment": "Malware payload (AgentTesla)", "value": "2cf144c9a1fc8fc3a15592696ae4250238347a2b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632264286, "uuid": "b3131981-ece1-4abf-8f6d-947ab73bf977", "comment": "Malware payload (AgentTesla)", "value": "8ec715f12a7219f2f25963fe33d3cd16af111ec6c4eea0e2bdc5a3a0d89cca6fcb9eafe645af9cf62356d7872b7ec47c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632264286, "uuid": "7acdfd59-2307-4751-9f36-9bb6fd5991a7", "value": "T1C7D4024170BE0688D7AD7B71206483413B73BE756833959D2ACDB08E9BB77818E75F22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632264286, "uuid": "e8e8aec8-2f38-4423-83fc-0abe3f38eed2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632264286, "uuid": "a84eb5f9-dc69-4faf-8927-6cf76258b3af", "value": "12288:KBIbw8eGGmtiK5ovU9XnwZKYKxKcXYeJ/vqw5BtZo1Yxdu:Xbw8eGG+FovsXnwraKel/vqwtZo1Y3u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632264286, "uuid": "7446f203-7dba-48d4-aed0-b486ab6c9ae2", "value": 634368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632264286, "uuid": "5184939f-c726-41c8-a5c3-56996516a380", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632264286, "uuid": "6e0c53be-5c0b-499c-a3ca-92f11d9c4efa", "value": "SecuriteInfo.com.Scr.Malcodegdn30.2867.21249", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "570a3d4f-1aa4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632205367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632205367, "uuid": "ae659bea-c2b4-4059-92e0-742a2f46a3a4", "comment": "Malware payload (AgentTesla)", "value": "350c0765eb6662197a5d67aeeb5bd742", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632205367, "uuid": "4348c88b-9c16-4848-9ddc-daa17bb4d0e6", "comment": "Malware payload (AgentTesla)", "value": "5779effc75ee5e8e33cc145c9311f57f4da77e1b163ec615d7be57952b9463a2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632205367, "uuid": "1f4563a0-0ec6-4f38-9e1b-4a32605c24c1", "comment": "Malware payload (AgentTesla)", "value": "0d15b26ce77c7304e135cb2ab9862f49cac71a0d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632205367, "uuid": "82082b82-a999-4209-b5a6-fce7a05b7968", "comment": "Malware payload (AgentTesla)", "value": "a4742b8464e2a39b913cb36afe5e865bc5e13f4b63a90d0ecfa47ffb27d32bbb14d1fc188abba4584a5ecd1a4f8c7e95", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632205367, "uuid": "b0354e5c-7739-4351-95a2-e416774b14cc", "value": "T19235BB294D2682F7C7EEC62CD09C0FCEEB62A4837B918F1ED89187D6065770BE58845D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632205367, "uuid": "27e9657b-79a8-4523-888b-3ae26f9a92cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632205367, "uuid": "4285b18c-2b6f-491c-bce4-e68a77254b7f", "value": "12288:z3mVngSyjVgg2RnNKFQQEQ1Wynxpc39pDU1/kZjOX:z3mVuj2g2RNKFzvnAIc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632205367, "uuid": "32037d1f-1f83-463f-9a36-9c073b483055", "value": 1084928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632205367, "uuid": "bf113c89-fa85-4a1a-a95a-0e0a4cca3eab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632205367, "uuid": "d54eec84-0c3b-4e30-a85f-293a7d85c709", "value": "Copia de pago 200003076_09092021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56332762-1ab6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632213097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213097, "uuid": "4ab55870-fd3c-4b69-8a1c-096068092cb6", "comment": "Malware payload (Dridex)", "value": "f5414aa9614a53370c442ac4ffbb7dba", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213097, "uuid": "dfa0c1e8-612e-4a06-9272-d80dbfc2ed07", "comment": "Malware payload (Dridex)", "value": "5811bb10e3e223c6ded0de512d81971d129ae01fa3b304cb868431b13eb010c9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213097, "uuid": "4c42186c-056b-4b5d-80fe-8cb9ee9b96b0", "comment": "Malware payload (Dridex)", "value": "2493c5faf1d67bdf6c56db182190d3a95bbe7826", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213097, "uuid": "23ee1f99-8e61-4c5d-a805-c9e964954015", "comment": "Malware payload (Dridex)", "value": "845ab9ec63f3471cad6ab6688f14a1a47d8d7ac5951812176f6f079d360fdc24ffb6d79fbdbdbc1b80a8aa87d896f0f0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213097, "uuid": "88b9a612-3c9b-4da6-bec4-962316ad920c", "value": "T17995D020EE69E1E6C6B89F3E9408352727F93D75110D608CC392604F5EFC6546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213097, "uuid": "b48fee7b-7bd2-4392-ba5a-91fb364c0e21", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213097, "uuid": "2c7d0e39-1682-470f-9831-f39fb1076276", "value": "12288:bVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:6fP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632213097, "uuid": "e462f0cb-e6b1-4d67-907e-092089c121fd", "value": 2052096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632213097, "uuid": "d1b043f4-d139-4bcd-85cb-60c17cb93574", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213097, "uuid": "6a9db9ae-b868-4a61-84e9-0059b80d3f0f", "value": "5811bb10e3e223c6ded0de512d81971d129ae01fa3b304cb868431b13eb010c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0caf8815-1ab6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632212974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212974, "uuid": "e6dc3261-520e-4210-a77f-c7688759b8ea", "comment": "Malware payload (Dridex)", "value": "a4315c6d1f6289ce1efdc891d7bc6335", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212974, "uuid": "8d8e0415-e0ec-4c29-a33c-ea803f670acc", "comment": "Malware payload (Dridex)", "value": "581cc8e8fd3756ac3c5d7f7b7dcbfbbedb9a5f17634a64c5c2729ad89eca0c0e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212974, "uuid": "9984e3f5-895a-44c8-b21e-e6b07fb60f3f", "comment": "Malware payload (Dridex)", "value": "9ae1c8b27c7f46dfcd3bbdcf96a0bd82664d663f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212974, "uuid": "ee894f8c-a74e-4829-ba1b-c29acc2a92f2", "comment": "Malware payload (Dridex)", "value": "3a1c1872d6d6212d8eafb23e20644db83922b383945071d094021f434f5d08403a12fbc3a974231f373360c8a1ecff65", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212974, "uuid": "2bdd05d4-1777-4265-8009-51419c8039ab", "value": "T157B5E020EE69E1E6C6B89F3E9408352727F93D75110D618CC392704F5EF82546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212974, "uuid": "07fb54b1-37fc-4d68-8a9d-3ebc4443223b", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212974, "uuid": "62b97e17-9673-4f27-8951-0a64e59d31cb", "value": "12288:yVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:vfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632212974, "uuid": "3ae9be4e-32c3-4d63-ab0f-8304b9def90b", "value": 2342912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632212974, "uuid": "ca105b32-01ab-4289-919e-6f3566c0f533", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212974, "uuid": "1f19caf1-5b06-43bf-834c-560c003e4800", "value": "581cc8e8fd3756ac3c5d7f7b7dcbfbbedb9a5f17634a64c5c2729ad89eca0c0e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f921592-1a77-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632186108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632186108, "uuid": "eb562f4a-a328-4610-ba0b-1ea248a11718", "comment": "Malware payload (AgentTesla)", "value": "c1a8bd6a0ce7335ed0a9a5afa738e92b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632186108, "uuid": "4d11c1b8-0001-4741-a1da-24026e067349", "comment": "Malware payload (AgentTesla)", "value": "58f69f2143a6e90ed8e69f05342e284b3e67879ad7adadc175accf12717846d5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632186108, "uuid": "1db4cf60-ea2b-437d-911e-916b91d2cf90", "comment": "Malware payload (AgentTesla)", "value": "c545a316e389f307cd22945eba63265d05d76e6a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632186108, "uuid": "31e4ee37-828d-4ab7-a874-0126f1fcc437", "comment": "Malware payload (AgentTesla)", "value": "759ddcefa452e6e27787145f434b4003d0d03cf817590af13296f9d8bca9a23d75bcbbd1238c0294162b8553b4a3bb10", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632186108, "uuid": "831a74eb-a3b8-42b7-a45c-d3fae70f8d94", "value": "T1E6457CAC3710F9CEC567EE3A96243E649B5071AA0317F343A52719E9E94E4CADF040F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632186108, "uuid": "b9f0e738-0fc7-47a1-9251-ac517f292e60", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632186108, "uuid": "5f6ac5db-6b82-43aa-8927-3a68a3f885f4", "value": "24576:brJecar0BrAgqyoFxDGal9JCSc1M82ASH2tfW6e0Z8Q:b9ecE0YGeASHCe6hZ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632186108, "uuid": "2ed2a27c-8bab-431c-ab7c-ecdbd6a206a8", "value": 1169920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632186108, "uuid": "de1de08e-6c10-4204-a1bc-45ec83234458", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632186108, "uuid": "6cef2837-fb9a-41f3-b38e-7be9cbe21463", "value": "COAU723334544564_xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "043d726c-1ab7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DarkComet)", "timestamp": 1632213389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213389, "uuid": "82c402d9-1f74-42c6-b357-e0359e80c7de", "comment": "Malware payload (DarkComet)", "value": "1d9b720db2f4e23c3502f1456f09b927", "object_relation": "md5", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213389, "uuid": "a26e1a8c-e2f3-4f2e-8030-ddd8e0b50cb9", "comment": "Malware payload (DarkComet)", "value": "5a1c8ef15cccd50082c6862f1df8fccc40cfa7b94e7710caaf60751c714c6cb1", "object_relation": "sha256", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213389, "uuid": "23f48ff1-68bb-41da-ba8d-4c9717752833", "comment": "Malware payload (DarkComet)", "value": "a68034b6084112066cc02565dd519a23757c1b15", "object_relation": "sha1", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213389, "uuid": "65b2e8f8-6ea5-44a9-b7a2-6dfc4cc6f2db", "comment": "Malware payload (DarkComet)", "value": "b8a91d296571ce6bdcff8128ea31d5a459dc32b1b23ba1a56d6c2245dc35e99fc6311f30889e45293c9f56bdf12dc9a1", "object_relation": "sha3-384", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213389, "uuid": "6266ace4-8c82-4924-8d93-79427279cde8", "value": "T1DDE48E31F1808837D93219789C5F92E6982A7E202E39754B3AE62F4C5F3D6C239193D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213389, "uuid": "ab5c513d-ac6c-4cf5-8707-5099c90ca966", "value": "e5b4359a3773764a372173074ae9b6bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213389, "uuid": "4ba6c865-b6d8-4bfa-9d2b-500151bc9068", "value": "12288:S9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hG:+Z1xuVVjfFoynPaVBUR8f+kN10EBA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632213389, "uuid": "771d6559-07cc-4d73-92ee-d26c3ffa1bf5", "value": 675328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632213389, "uuid": "e6999f04-5f0a-49ff-b0dc-afe8f966a030", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213389, "uuid": "8ffd93ff-5e67-4501-8ce2-676bd7748297", "value": "5a1c8ef15cccd50082c6862f1df8fccc40cfa7b94e7710caaf60751c714c6cb1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f17a89d5-1b11-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1632252442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632252442, "uuid": "9421f1b3-f6ba-49e0-ac8b-bf689471e089", "comment": "Malware payload (ArkeiStealer)", "value": "457d7ef9f088f3a94d6ce53f3fe38eed", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632252442, "uuid": "f3705568-d90e-49d5-a8a8-317855457d74", "comment": "Malware payload (ArkeiStealer)", "value": "5a62209b7c8f609b5eb269ab0f6f0d4162e86418d8f2775c15355853b6ed7daf", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632252442, "uuid": "ed72aeaf-16fd-412e-aeac-5046fc63af5a", "comment": "Malware payload (ArkeiStealer)", "value": "049f28adf785cbbd49ac92152f59a6bc32bf69b6", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632252442, "uuid": "4b91baef-7527-48e2-b824-b77e118fe8c0", "comment": "Malware payload (ArkeiStealer)", "value": "635c4cd7b1f1bee1b8df68374764da3538cd6ddc6508ee37d7501a79a914dbc4988eaa148bbb400b225bfa4e730cae16", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632252442, "uuid": "36a77abb-efd5-4bb6-8d5e-89f8b4987024", "value": "T11EE412013AA1C230C57BB5704762F7B1262B7891AEA057873F966B1DFF262E077623C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632252442, "uuid": "09fb2103-71ea-461a-b26a-76aed42384b1", "value": "b4a5f131bf57e0871ab3cda52113b279", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632252442, "uuid": "3235d92a-0842-420c-b0b2-2025c7bb0b96", "value": "12288:cDsa2KNr8EautZLjDcCaS2wxOA7EzOqhZMtGIBsAfwVBai:cDLDNrBfwCaSX8A7EzsGIPfwVh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632252442, "uuid": "7a35cd32-efce-48f8-9359-f9c2f4632036", "value": 673280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632252442, "uuid": "db9f1563-de90-4183-ac91-ecee89775c57", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632252442, "uuid": "16c4d2f6-2cff-45c9-a3cc-51607e729fa3", "value": "457d7ef9f088f3a94d6ce53f3fe38eed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14a2b7b1-1b17-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1632254648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632254648, "uuid": "3f2503da-ded0-4c96-be0c-4fc8e60038ef", "comment": "Malware payload (RemcosRAT)", "value": "b5b75b3da47bb461fceb52a2c69d1240", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632254648, "uuid": "c6b7b799-eed4-44b0-9e7b-1610d6a6c6ac", "comment": "Malware payload (RemcosRAT)", "value": "5b445bc2e8cd529d16ff02a4c2bca711a6ad0a9e306f6a7353ade3b80d70c38f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632254648, "uuid": "1aba0d86-8545-417f-9e7f-6a0b2b0ebbb6", "comment": "Malware payload (RemcosRAT)", "value": "3d316498e11abbbc4b03049def69ac2d9c07a242", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632254648, "uuid": "a1ef90d4-eea1-4d47-91c8-dd66e765524a", "comment": "Malware payload (RemcosRAT)", "value": "c7281348e32742147ca5c9e50aba9ecdcb641762521cba22549cf74ef95290f901f8ecfe18fffcbc8e64f65650a0732c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632254648, "uuid": "e9c69fa1-0d2d-4f8e-9422-614b35132738", "value": "T1EFE4DF722A05FBCDD67B8DF8EE812C10CD572DA3896D4588A484E6FA10F3134DB59CB9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632254648, "uuid": "f68a9df9-a9d4-45e3-887a-9bb6c8a5e0ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632254648, "uuid": "a681f727-e4bb-43a3-972d-c2dcdd07b59e", "value": "12288:cS/HwtbFL1/gNhrnYulyu7pkv/tpr5Oog/VzoxyNqkbT:cS/m/gN9nhlyuutWxNqkbT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632254648, "uuid": "1159babb-e014-450a-a19c-a2db8d30843c", "value": 668160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632254648, "uuid": "23f09e94-088d-4cb1-bdcd-06586cc938bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632254648, "uuid": "41aec10c-8dc4-470e-a025-a5d5563fafe4", "value": "b5b75b3da47bb461fceb52a2c69d1240", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd840c8a-1ac0-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632217592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632217592, "uuid": "9ff9a748-d160-4e3f-9759-7a019883b1bc", "comment": "Malware payload", "value": "354cbf95abc79189e152b62e9e56f6d0", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632217592, "uuid": "37df605b-108b-4a7a-a544-f564ea69754c", "comment": "Malware payload", "value": "5c63d168c085392a8fbde99b3184ac1c45ddafc129dabf28c089aef848605c9a", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632217592, "uuid": "c948bab3-f25a-4a87-b921-d1a91bfb6a16", "comment": "Malware payload", "value": "058f3e47b0c43526bfab9439240905e21d2cf50d", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632217592, "uuid": "4f55f519-93bf-47df-8bc7-361e755d79d6", "comment": "Malware payload", "value": "e538b30d03872fbc24660c7c1a306c427534ffdb868d3bde2bb02f7dc9c2eba5c6a6f67d17f942f53c5dce84a77f7ecf", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632217592, "uuid": "ea6aee6d-ef43-4817-93a4-083e2936feaf", "value": "T11091F8B18E8C2D53CB1744FBD254BEA216A7F27585DB1644320EFDB10F1A2296C39981", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632217592, "uuid": "ec1b82a6-f5cf-489f-973a-f0c621c28352", "value": "96:oKmkJZrAUmlALfd5CHaTxiBUftoPiY3jFDP:owAUOAnCHQxiBUO3jFz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632217592, "uuid": "74eaef22-882b-42ee-be35-982bbc406d6c", "value": 4345, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632217592, "uuid": "24ac0d12-67eb-43ef-9f1c-1f99fa05134c", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632217592, "uuid": "318ab476-aea8-41d9-a4b1-527a27248a43", "value": "PO0099865.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94073c55-1b1c-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632257009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632257009, "uuid": "bf026d2a-72f1-4596-9690-1b19a777374d", "comment": "Malware payload", "value": "7dd1032cbeb2b3f61e727060a65a839f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632257009, "uuid": "08f40e9b-5ffc-4b88-99fc-b9eeb9879fad", "comment": "Malware payload", "value": "5da40f66abf1b576b009e3f4c6b16156e2daa844d21385ecc4eb69ab023411ce", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632257009, "uuid": "75bbf978-5368-4ef5-bd0f-52abdb5104e8", "comment": "Malware payload", "value": "5180d346f22711e4460787c4fce3f2b28440fef7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632257009, "uuid": "e6b2c707-c297-421f-9f7e-70c246c75dbd", "comment": "Malware payload", "value": "1abf13b0bf8e1577a5d95e7b988f399e456f62196bf669dfa0d9b4539b7770c16bca741c78ae13c1d6e0fd70f5a0213d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632257009, "uuid": "72d4fce8-39c5-46dd-942c-94b22badf524", "value": "T1CD947CB25E0EFDA6DA6A09B9C4C025320C971D7702605598FB8B3D9BF17750CCDA8A73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632257009, "uuid": "5e93de29-a599-475a-b275-40f45087c902", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632257009, "uuid": "fa2dc806-f904-4f28-ae72-fca7156449f3", "value": "6144:3XzvbmyJINH4KEkljlHWz6mrbJG3vT5q6IDdxEyJcjBCdZRZr0TR+XiXrSQGBHTH:3Xzqi+NHF75ED83jYdllXiGQ2+Wac", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632257009, "uuid": "73a0cdf5-25fc-43c4-8f9b-4d73c086f993", "value": 445440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632257009, "uuid": "b50e2e6e-3807-4fc4-89a3-6eb1f59db0d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632257009, "uuid": "06869bbf-70af-49ee-9654-46ebaf39ca53", "value": "7dd1032cbeb2b3f61e727060a65a839f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0e899a4-1ab5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632212820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212820, "uuid": "65dc9f99-83d6-4e1d-8d94-88ba41f31f82", "comment": "Malware payload (Dridex)", "value": "844b7eced4bde79a2a22e9940b402d76", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212820, "uuid": "677feeec-4eea-4f84-bc82-1bbd30e37776", "comment": "Malware payload (Dridex)", "value": "5df8c4e15768e5d6f336e36132c7d7a1fe3d8779ffa43af757eaa751bcd68176", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212820, "uuid": "adc022f4-13f1-4721-908c-1b4a2c7594ca", "comment": "Malware payload (Dridex)", "value": "8882563bc574ca63dc8617c3d36f12ff8b2417d0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212820, "uuid": "2be3c3d7-ed15-457d-a139-8f4f7b80bb90", "comment": "Malware payload (Dridex)", "value": "ca046e8860c7ed2dcdceda79a1ff2586b86ab43b73494368c47f5d35024308e87445ca4aec5a348be1f09183b3b5e215", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212820, "uuid": "a00303e4-41a9-4a79-a311-aaba25a270fc", "value": "T132F5D020EF69E1E6C6B89F3E9408352727B93D75110D608CC392604F5EFC6546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212820, "uuid": "9dc9f24b-1a69-43d5-83cd-8f9f280709f2", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212820, "uuid": "8249b6f4-0c8d-412b-bc64-0d8946d91925", "value": "12288:0VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1n1:xfP7fWsK5z9A+WGAW+V5SB6Ct4bnbn1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632212820, "uuid": "2ba75094-4006-4778-97c2-a95dc6f22858", "value": 3420160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632212820, "uuid": "5b544e0a-2cab-489d-98cd-60369f1fa5a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212820, "uuid": "f046b72c-34e7-4182-93f8-5075c81761ac", "value": "5df8c4e15768e5d6f336e36132c7d7a1fe3d8779ffa43af757eaa751bcd68176", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8de3bbb0-1ab3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632211902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632211902, "uuid": "39de8fda-5b4b-4f3f-83fc-b203b0fccc53", "comment": "Malware payload (AgentTesla)", "value": "ae7afd363fae131963647855ef731e1d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632211902, "uuid": "6480d6a3-7c00-4066-83ae-a5404bae39da", "comment": "Malware payload (AgentTesla)", "value": "5e82d4c82465ca567c0b34eb576ccac278636370cdc42f948f27ab333e7e6551", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632211902, "uuid": "5595be61-1cba-4acc-9078-ae9b33190cc8", "comment": "Malware payload (AgentTesla)", "value": "43077d9f07ea10209920cb55cfa91f7a5fb2f238", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632211902, "uuid": "62676fa9-54d5-41b7-8f9e-24df1c0fad85", "comment": "Malware payload (AgentTesla)", "value": "5c64a50ad8fda0da80851648188bbc5c0221b6991c07fa2b1e1924e3c2ee7664711fa6dd1babd54f2a64045543209e28", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632211902, "uuid": "b83cfb5c-20e8-4cc9-a648-8f390b7e0eb5", "value": "T1EC05ADC17D47D89BF0DF6AB398AFC02015646E8D9165C73D2683BA2B54F3352306BA4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632211902, "uuid": "1c4b1254-7e5e-48b3-ae3f-21eb5e22da6e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632211902, "uuid": "ee4a8b47-b74e-4153-922a-f985a42c17b4", "value": "12288:CenYqGsmtiK5oUZOlNr7velHzwfBFyo8wRiD0GRGQK:B+Fo1N3GNzyBFhkZK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632211902, "uuid": "d9907e08-4e4d-4787-a803-d554f11ae307", "value": 824320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632211902, "uuid": "c74815c0-6074-494d-abd5-657365a2ec8d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632211902, "uuid": "9ed24823-922a-4828-890e-35c2a550c6e0", "value": "ae7afd363fae131963647855ef731e1d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bea021cf-1ade-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632230452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632230452, "uuid": "4b8b5e25-fb3c-44bb-8a53-e1414777f662", "comment": "Malware payload (Formbook)", "value": "c1688fa587d048aed6e47e0f9d1d5037", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632230452, "uuid": "b29e3de0-2a7e-4fc7-a4d1-328a518c0a60", "comment": "Malware payload (Formbook)", "value": "5ee16ef3270effce196090de88536ab21e4bf6ccc7b16ddd54c68bc44c3045fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632230452, "uuid": "a02d556a-098e-412e-b1d9-78f288edba63", "comment": "Malware payload (Formbook)", "value": "2bc636faa40213c86d0bb744e8e1d3b0748ef46a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632230452, "uuid": "821821d3-3632-4dfd-8e82-1b7d2d7046f3", "comment": "Malware payload (Formbook)", "value": "c0de220040fbd6e56e7679be8a52b70ddafea1f0a71ac12cbc71bc2ef7aeec4e781c7187305317673c9700adaa924f69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632230452, "uuid": "161f1621-e64f-44c6-86dc-b99857d3b372", "value": "T18CC44A0113E08714DA7E2B307A34521193F376EB5972D77E8A8151EABFA33066F4B366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632230452, "uuid": "e4a94f6e-7196-47b2-8440-1e476cc9e9c1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632230452, "uuid": "797420ef-a2a3-42ae-809a-f11421fbc69b", "value": "12288:PW6MpMVBifaladf14E3zkGihiiQSYtBy:+v5ylazrzKhGU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632230452, "uuid": "72e81cf6-f5c1-464a-beb5-9ce9de55c698", "value": 558592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632230452, "uuid": "59262f8a-1b02-4ca2-af26-520191130748", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632230452, "uuid": "c8459556-b022-4c5e-8687-27bdff544577", "value": "c1688fa587d048aed6e47e0f9d1d5037.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d596a92d-1ab5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1632212881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212881, "uuid": "c1747341-df1a-4970-822d-d9823c5ac1da", "comment": "Malware payload (AveMariaRAT)", "value": "3e437c1a3b7db89a583070c0d07ef7c7", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212881, "uuid": "dd612842-4437-45ac-bf34-4e453dc5da6e", "comment": "Malware payload (AveMariaRAT)", "value": "5eff5300ea097fb161db0c11ad31f2b2ad44609b5042f5547d433e3ff83e507a", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212881, "uuid": "fbb79c27-b502-448d-8ded-247dcea658ac", "comment": "Malware payload (AveMariaRAT)", "value": "e31dec207d039076a54072cf19426185ad2cde5a", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212881, "uuid": "c9b7f404-2f11-4f76-910a-d0d04fe77370", "comment": "Malware payload (AveMariaRAT)", "value": "9f01f85f580729f0d7fd5b2c61af542559380f20660470a759c1ad464735f3a0e9bdf48e1ba6e7c22797b9e0fc344d83", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212881, "uuid": "35d3b0f1-4a31-4683-a85b-2a1f84f396ce", "value": "T153D5AED27957408BD73B1677650FA5208799FE38A3147F8E6FAA3805C4732E2D643A0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212881, "uuid": "c29212e1-480c-41f2-b92f-67b91ca4bc48", "value": "6bac3cfe8acb6c6c4a30aaa022de2388", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212881, "uuid": "8b49045c-e2b2-4b84-b469-6046523fbca7", "value": "24576:ssF6mZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eH81S:fF6mw4gxeOw46fUbNecCCFbNecQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632212881, "uuid": "ada76a86-2637-441b-90d9-b5070dcae0ad", "value": 2806510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632212881, "uuid": "19088ef1-f0af-48d2-aa05-69d2f672ef8b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212881, "uuid": "9afe6277-d398-4897-b70d-3b49beb7e657", "value": "5eff5300ea097fb161db0c11ad31f2b2ad44609b5042f5547d433e3ff83e507a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7b8a120-1ad2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1632225313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632225313, "uuid": "5d7d6b74-6a14-45df-86ad-58b0bbbef249", "comment": "Malware payload (RemcosRAT)", "value": "7b67892fcfa82a8d85a8c6762fa47ffe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632225313, "uuid": "d116b400-d0aa-4d85-9d4e-a01fae695ac5", "comment": "Malware payload (RemcosRAT)", "value": "5f14d3a74387554c330e7ee790f26fb55c5bfeb1dbefc6f2de93ba69d46383e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632225313, "uuid": "ff8a7641-27a9-42f3-a036-34439a6d8f65", "comment": "Malware payload (RemcosRAT)", "value": "00252b7f843bc889697b94b9865f77dd6c83b934", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632225313, "uuid": "7aa32393-85d8-43c5-b1dd-e3a699ab21fa", "comment": "Malware payload (RemcosRAT)", "value": "8a354c469c5af1164587a5886e3aabc2b6feea10cc9f3cce7c3b35ebf6d07975f727bdfa9504ed4d14ca73ee06e11e71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632225313, "uuid": "9bbf2a33-2576-481d-af90-52bb4addd7e5", "value": "T157357DE2B345ECA2FC24353EC946B15413247FF538024D4DECA06F4F6A95AA1FA5DA83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632225313, "uuid": "51e010ad-80d0-4ffc-ad17-83acaa1d23ae", "value": "bc8cc1eea5c25ce2056d7da92bd98134", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632225313, "uuid": "8cdeda22-e573-4f42-9f95-c1a006639384", "value": "12288:BSZPsJUL/MN/cen/VwTQBXcameDCnNmTeoAdrL7+o:bOQN/cu/VdBXKyCnEKrP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632225313, "uuid": "eac07602-1773-4d05-80f5-501d375beea1", "value": 1080320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632225313, "uuid": "96c8a9bc-3053-44be-a4aa-15f244793acf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632225313, "uuid": "c8c322c5-7d0c-4db6-a714-1b3a0ce2a30f", "value": "QUOTE LIST ,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e10a922-1aa4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632205460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632205460, "uuid": "b0eefed4-2b4e-4550-a1ef-a68a3f9a99f0", "comment": "Malware payload (AgentTesla)", "value": "a05d113ee784214e39d4999e29541cb9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632205460, "uuid": "8013d4c4-6023-4035-af63-5e3567469ecf", "comment": "Malware payload (AgentTesla)", "value": "5f377bcc0b2d57eda0a3cbbcdaa22382397c1f65459b75e088a272750639451c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632205460, "uuid": "ba00fe3a-c71a-4212-9365-a6a590a3d004", "comment": "Malware payload (AgentTesla)", "value": "fd2062ad3bf1bd695620104771abc5789ea25c22", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632205460, "uuid": "a4f82f8b-6e9e-4f70-8e2b-c28c7120f0b4", "comment": "Malware payload (AgentTesla)", "value": "6c77311b8315608291b6a8b448980c17d5b53c1459bbe510691a2a40e176ebcf97cb8f3ea41d6f5c4a3dff1696b21304", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632205460, "uuid": "8b81e6b8-1149-4f40-9674-33d741c805f2", "value": "T1D534120626E14A6FC2D74A30543AF376F7BDD95281A2A1832F499FBF2173647C60B352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632205460, "uuid": "297b2563-bf05-4d92-a487-839ce28e11fe", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632205460, "uuid": "6405ec94-206c-403d-b4ea-a639ee965acf", "value": "6144:p8LxBZAPHQU8p73KyoFTbbFjUxKEJ8OKDGUmt:uAPHMp73rGTbJjuGOKqUI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632205460, "uuid": "2e0a3482-b763-46de-88e9-a18f95dc5ca0", "value": 244455, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632205460, "uuid": "b0d667ab-3eb6-47e3-98d8-ccc75c97f69a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632205460, "uuid": "8fa88b37-cddf-40c2-90b5-16d753ac3eb7", "value": "justificante de la transfer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea0bbfc6-1ab5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632212915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212915, "uuid": "9d7a7f63-1492-4d15-959b-5394b2136fe0", "comment": "Malware payload (Dridex)", "value": "f41820d6fd8a84f7a732481e5e9ce259", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212915, "uuid": "7f507cf2-5b08-450d-bb58-d0fc42ac5339", "comment": "Malware payload (Dridex)", "value": "5fefa719c11c0ad8472f9c610aaa9cd4a487077ed06aca94fe71dd20cd486394", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212915, "uuid": "11625b84-1589-4ca3-a0cd-ba4a514b0b05", "comment": "Malware payload (Dridex)", "value": "2336cab8c4b712fb61df1f29e37a04a6ebc97e93", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212915, "uuid": "3d2a3d75-1857-4fbf-866e-ebee05290c0d", "comment": "Malware payload (Dridex)", "value": "83816aad16b4a730d16da16edaad13b203a40763a96b446c75e1d2443ab37b8d26b466788c2288e7fb62f6e3f4efbd54", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212915, "uuid": "ec55bdd9-92b3-4491-92ed-ea88166c975a", "value": "T105C5D020EE69E1E6C6B89F3E9408352727F93D75110D608CC392604F5EFC6546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212915, "uuid": "50267c0f-c6e9-4927-807d-23448e2c43f7", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212915, "uuid": "77b51c17-5d47-4142-8b39-9f107b5a8d58", "value": "12288:+VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:jfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632212915, "uuid": "cafd6e54-99fe-4203-8456-ca161debd7bf", "value": 2617344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632212915, "uuid": "f3949e31-ec3f-4b47-8b2c-97e617904585", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212915, "uuid": "7197aff6-456f-45e0-afa2-7f650ca61c47", "value": "5fefa719c11c0ad8472f9c610aaa9cd4a487077ed06aca94fe71dd20cd486394", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d57984df-1b10-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632251965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632251965, "uuid": "fdcfc28b-1539-48bd-ba64-edd472aa83cb", "comment": "Malware payload", "value": "54c351236ba33c74a10f1fcccf81b4fd", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632251965, "uuid": "d6f4b35f-258f-4c25-a7c0-25277470ce91", "comment": "Malware payload", "value": "61005cab010bde9798cb5c7ee05497c08ba71d638644f05a1b5e58c8eac67ca1", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632251965, "uuid": "795d5979-f0ed-405f-b517-51cd94b618bb", "comment": "Malware payload", "value": "fa734041869ffc2e811aaaf6ee5e9d26f196e53f", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632251965, "uuid": "10c1693a-f2ed-45cb-9ddd-b31cb479e83c", "comment": "Malware payload", "value": "ad19b63f1be8b9afaf418b5157c49943d440e98e919de58cedb51f8f2fefe76a599263c8de817e1b4b58e332955f0795", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632251965, "uuid": "77dcfe7b-0e7b-4e72-aafc-4bdfb85f8b13", "value": "T1732412127E80F869F3DEA0F8C6BA929357044F9551CB1057B9AEF0DA7B717E12D8C40A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632251965, "uuid": "4c372b8a-a58d-4604-961f-87cee58dea94", "value": "6144:tGkA+6vAmW5261qSQMaMFc5K+CkmOvsGh5KAb43eFC:tkVKcn4cqkmOvSuFC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632251965, "uuid": "a71712c5-a645-48a0-b290-30432c1d01ff", "value": 209422, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632251965, "uuid": "a4e0e22b-a941-4064-a042-f226e9c13186", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632251965, "uuid": "7b7a8989-5560-47eb-be28-5280d608b5d1", "value": "BoFA_Remittance Advice_21219.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0d19197-1ac0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632217571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632217571, "uuid": "98edbe71-456e-4c58-a947-d35060844060", "comment": "Malware payload (Dridex)", "value": "a5513cadb437d6243dc463d836a03e62", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632217571, "uuid": "bbee1d39-7ae7-4e4c-8af5-5d4f8170efe2", "comment": "Malware payload (Dridex)", "value": "6232728af29302ef0a4675b3c5a255b5e9ee800c221823ecb4d4cab8cc0f7edb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632217571, "uuid": "89708490-6e83-4948-8c3d-3f5bf5a735aa", "comment": "Malware payload (Dridex)", "value": "a16e4767112e43f150a255cad6c56d440d945380", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632217571, "uuid": "59b639a0-3ee2-45d3-8abd-8cfdc01279a6", "comment": "Malware payload (Dridex)", "value": "ba48b7b6b3fdb6c14630c300a2dffe0b391932be06cdd95a4cdabc358e7da3c08774f203ae067a1e94a3279f1c809f76", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632217571, "uuid": "5f9921ad-416a-4bc5-bd85-a6cc6b76c64d", "value": "T11615E0036BEC5DADD8AAF63115EF4E21557EAC229950D43EA6C83CCF3DFD6A20502352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632217571, "uuid": "6ed82f26-9817-42e3-b79f-8206b273f521", "value": "65b7d80ef614b878121194bff58cf2d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632217571, "uuid": "a04406db-826f-484d-b813-7b75a7827aae", "value": "6144:ZXK6cyPiWCgknQ/HuyIzuTVzsMM56519p+6yTx3NJsQOe3MnjWRza5GZa:JM+ZdkmHubeaCo6CspCMC5aAa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632217571, "uuid": "b06be236-76e3-457c-aa5f-d8aa2c21b4ef", "value": 911360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632217571, "uuid": "9fe66a49-c228-4693-9815-09fff3b601f1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632217571, "uuid": "099a3429-5141-4bac-953c-ed38d08babcd", "value": "a5513cadb437d6243dc463d836a03e62.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb77b0e6-1b0f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632251492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632251492, "uuid": "fbf3e102-37b1-48bc-8ac8-ef0e785000b8", "comment": "Malware payload (SnakeKeylogger)", "value": "24c00aa6598bb38892b94e3e2184a1e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632251492, "uuid": "b8f08d4f-63cb-4379-b6dd-86ba0966789e", "comment": "Malware payload (SnakeKeylogger)", "value": "624372a4a8315b29642019bcb08e888d17d4784eb33a6ae28c495fb0c4d7c04b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632251492, "uuid": "ffe1ce6d-0ba8-420b-9864-62756b33112f", "comment": "Malware payload (SnakeKeylogger)", "value": "f52cc7fe21e082491625d7e565edcaa274dcdc0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632251492, "uuid": "df30bac0-fd63-4486-9f8f-efed9991d27f", "comment": "Malware payload (SnakeKeylogger)", "value": "eb10c2d596c7b41289b7465e7a1ead18801448d8379a60a925c6ae62854a564f5fcdff5b2b96577de159ec162eb96e13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632251492, "uuid": "33da0335-8caf-4c10-87d0-54c747d35b1d", "value": "T1E4941238C73593B1C62E9FFF056244490F71A28AA713DB3B6BD270CAAD0779291158B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632251492, "uuid": "9abb09a0-8bb1-46b2-ad30-907f14fe0a65", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632251492, "uuid": "8924edc5-887e-4736-9393-ca21e5b7a19b", "value": "12288:9JcqmtiK5oBYXJRiThWGMJlnT6yBKGTapduI:R+FoBYXTi9MvnzsGTap", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632251492, "uuid": "3eab0bba-39a1-436f-ba62-e73554ac3a41", "value": 432128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632251492, "uuid": "3a5429d5-2c9d-4dcb-8b79-b81a788a3294", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632251492, "uuid": "1c933102-6268-4d8f-a656-e02d08c2d9a0", "value": "PO09858.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e91e0bd7-1ade-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632230523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632230523, "uuid": "9b342379-bae1-4d9a-87a9-5dab1a536793", "comment": "Malware payload", "value": "4a0f9d7e858b278ed038fc3b303d61f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632230523, "uuid": "bac4f59d-8136-4c24-a2cd-3e84f3dd0da0", "comment": "Malware payload", "value": "62b8e32685c97713840362a31c20cf925d30cb55881f5308744dfa7cb5fc7a5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632230523, "uuid": "4dc92037-40de-4847-b380-6b0c061b129d", "comment": "Malware payload", "value": "35e20457f8d4973dc41b269f6fbc2806d5cd85b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632230523, "uuid": "fddb7373-4d05-4c0f-b891-1fa18bb53f38", "comment": "Malware payload", "value": "c207533c67543105ebdfbb45ea8e900863f8f7a8ea9948804dbf0af128d9ac52b5e6afcdbb788bff35c1d20cd6a666c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632230523, "uuid": "4a5c9e45-1e85-436f-87a0-9fee2c9f7197", "value": "T1E0B3F63BB6047378F3E37F37586271D746A2297B192E6705322862DD37B6BA86833141", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632230523, "uuid": "8cb13b4e-e374-42de-8b25-f127c7bfcbbb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632230523, "uuid": "d4c38d45-94e3-4fb2-a0dd-9b29264904e2", "value": "1536:P/1HIwKJmvG0j4PZdZEXN0zv0wRoEA2TmQRDSTlM9wM:P/1lKgGFPZdmkSlg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632230523, "uuid": "c8686d20-086f-4800-a261-e76c77717fc0", "value": 117760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632230523, "uuid": "6be210f6-9cc6-47c8-827a-94dbede046e3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632230523, "uuid": "23985d0a-ee48-4537-9ada-d364ca81cbb3", "value": "4a0f9d7e858b278ed038fc3b303d61f7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65cc85be-1ab6-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632213123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213123, "uuid": "553ad3b9-4032-46ef-a043-9b44d28433a1", "comment": "Malware payload", "value": "ab79f950b58f426375155ef3d17e6db1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213123, "uuid": "417bd279-ee70-42b3-b380-48419246e7f9", "comment": "Malware payload", "value": "6339a14fb049a069fed24b0a9827ab82710426e174139d172a6536bfb1519402", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213123, "uuid": "9b4281da-e94d-4a45-a0ff-cba2c5e98bed", "comment": "Malware payload", "value": "0028aafc5b29b92c9ca5ed28ae01981a679ddc46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213123, "uuid": "4bb67e82-15c8-45f1-a13b-2aa77f36d60b", "comment": "Malware payload", "value": "884418ae522ad1c4e3bcc0bdabcbd7e36f6d15ec31174d6a81a9ddb5c8789411178c34bc8a554d5460e2f21f2c31d718", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213123, "uuid": "23977ae4-422c-495a-ba9c-e425ee65980e", "value": "T19B8529F17380E55FE5D68A768FEA84221A73B10EC899910A2A417F5F2C323F61732577", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213123, "uuid": "4d01971d-7f03-4315-9e71-4c42df960fdb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213123, "uuid": "f72cebf5-7859-4999-a318-753c3c5e55b2", "value": "24576:S0nPG4U2stsLaEvLaE1UAmA4icHqDOUEURmow1mbJo0SpVy1r3j4If:tnuccAmAXhX8ow1aJqVor7f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632213123, "uuid": "5d46a929-d4ba-47ba-a790-740868ec77c2", "value": 1802752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632213123, "uuid": "6cec022d-6fbd-438f-b9fd-fd60458deb41", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213123, "uuid": "453060a3-506f-4525-ab1b-f9ee51e4ee66", "value": "6339a14fb049a069fed24b0a9827ab82710426e174139d172a6536bfb1519402", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9b1799b-1a83-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632191413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632191413, "uuid": "08955ca4-c6ab-44ae-90ba-6c37da19cefe", "comment": "Malware payload (AgentTesla)", "value": "55831125d9f7861dcf5446aca81e57f8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632191413, "uuid": "05a11eae-daec-48cc-928e-00920217435b", "comment": "Malware payload (AgentTesla)", "value": "641b9400b184d78647e1199826101f85762a534cbc79239a2d10a042b1a09651", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632191413, "uuid": "4e8d8191-15c9-42cd-aec6-4d704c7a59d8", "comment": "Malware payload (AgentTesla)", "value": "513050eea896de5b16929cd1c2c05cd1ee8f12bf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632191413, "uuid": "6f012959-f6fe-4c34-8905-53138d8f5188", "comment": "Malware payload (AgentTesla)", "value": "3134db65f6f5ef161d74d7ca284e99333c134757d653dc1149f4cf2587b3aaa175fd2624d212ae436d5017c2db78557c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632191413, "uuid": "ca6f4013-a504-4994-908e-4aa9fe2c7159", "value": "T1E1156C394D2682F787EEC66CD08C1FCEDEA6A4837B919F1AD496D7C2025770BE48845C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632191413, "uuid": "3cd62157-58a8-49ab-8d4a-ff82597fe2f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632191413, "uuid": "64a933b8-603c-4ab0-88c8-0a25e69ac6e7", "value": "6144:EyNZkUKC0JifyN8Dkv67/bYRgUMqKdbwK8WdXJl0nW+b3EM9CyLPCw9f:EKh0JGiPoz4gUML58WdGdzZRrC4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632191413, "uuid": "c42357e1-658a-4c9d-bec5-165f6ae08fc2", "value": 879616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632191413, "uuid": "dd6f4b94-5d09-44a0-9fa0-8ff6d5ea6f07", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632191413, "uuid": "3d289530-5fa1-473a-96d9-75526f3ca0e9", "value": "sale order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf655ef8-1aec-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632236493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632236493, "uuid": "4c672128-dd83-4bca-af06-50e34e230068", "comment": "Malware payload", "value": "b99cfc42e450262149e21190543ae28f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632236493, "uuid": "a2794b42-0b98-408f-9bfa-cf6a7241789c", "comment": "Malware payload", "value": "644665e6a21a0d87ec8d65145fe8b7b66e99468b99ee34c12e81726297d17b72", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632236493, "uuid": "07790408-b0ed-4603-9073-2c8a47fe9d3f", "comment": "Malware payload", "value": "7760d0ef7f0e83898482eacdd599908d59557359", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632236493, "uuid": "221e90d5-7114-4605-80b9-ad7d2d254e19", "comment": "Malware payload", "value": "819d4ac27d63e57df935a92d3e276ee63cf4739f080a21d185f0224b5b1f578d53284aa04ada52ea43ecaf8e7b1d1ea3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632236493, "uuid": "ad84ff88-aacf-4801-b748-278b0b367b91", "value": "T12723F2B5448E8D718A40E872D56FC70617A651F0FDDF78490B0A632E88CA5DF9FF848A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632236493, "uuid": "65c7f5f2-c060-42f6-8271-6723dfbe774f", "value": "768:jjuT6k4qIGFcNYI9wL5oUn84H7TOT99F0kmFaSx3CwPJKWIJD5nCY3UvckcBLnlN:ji6MFcRwaUp7yJMkmQdwPoWIJD5iklUe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632236493, "uuid": "59d4b596-cc8f-4d7c-b862-6af911eb652a", "value": 47528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632236493, "uuid": "572a1246-ca35-4d91-8b86-1c843146baf4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632236493, "uuid": "5775c7dc-d338-476e-b558-196adc1ad181", "value": "b99cfc42e450262149e21190543ae28f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab427613-1b11-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632252324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632252324, "uuid": "cbb5a9a3-c464-44f7-a6f2-6758cae231d8", "comment": "Malware payload (Formbook)", "value": "259c7a6403af1553ed0436fbf9e592b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632252324, "uuid": "daa7a084-9064-4b5b-aa24-31fce22f2a20", "comment": "Malware payload (Formbook)", "value": "64c00be3d0bc5f000ee6d2d6d49e72c9e9f36090f19b7f9620ff0993a0e84025", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632252324, "uuid": "5e3c83b7-6325-429b-bd8e-c3868e7641b6", "comment": "Malware payload (Formbook)", "value": "b0aa55e4f8a14c48f844a3e90e9ba74e476fe0de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632252324, "uuid": "9882961f-22ea-402e-a3e7-dc97e78adbdd", "comment": "Malware payload (Formbook)", "value": "aafa291641bbc1b5f2303ad64d3fb25e602afbebfdee39b0dd75d4e07e6fb7cdcf758c1f4a732a819b39c9b14e438e8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632252324, "uuid": "99f45897-faa5-4141-98c9-d59aa6ba706d", "value": "T1F74412AB74E086F7E1C7A6791CA9FB78FB74670901142D0B075C1E665832ACF874FA06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632252324, "uuid": "05953a8d-6244-4edf-995f-5bc5f1a1110d", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632252324, "uuid": "5bc8628c-9b3a-49bc-904c-4a8c75d5fa21", "value": "6144:l8LxBjusZ5VHR/3cQeDUElcEIbJB8mJPOt5bFE5PDJur:0DZ5VtMQevcbJX2t5SJa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632252324, "uuid": "90136a68-c052-490a-a38c-bacc1ce0de63", "value": 269095, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632252324, "uuid": "39198d86-ea83-4924-8f68-b743578e7a81", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632252324, "uuid": "cfb2b9e3-6cec-44ad-bf8c-2ee3b90947fe", "value": "259c7a6403af1553ed0436fbf9e592b8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac9485ab-1acd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Squirrelwaffle)", "timestamp": 1632223120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632223120, "uuid": "134c8c7c-a4f2-460c-ac11-59399e3c93d2", "comment": "Malware payload (Squirrelwaffle)", "value": "22aef4558853a72dd07ff9513a6b9dbf", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632223120, "uuid": "2b9624b5-af0e-4c0f-8b6f-60b20920bddd", "comment": "Malware payload (Squirrelwaffle)", "value": "64c044cb3ec26babdd17107b2aa6ded60b22473c4e2943e1fcc03df8bc2e0edb", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632223120, "uuid": "40e59a25-f5af-4a25-a990-7f058a585598", "comment": "Malware payload (Squirrelwaffle)", "value": "52a914b43dfa44910ab649be77a57db631d038ee", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632223120, "uuid": "b233bdda-203d-472c-9314-ce52da4657f8", "comment": "Malware payload (Squirrelwaffle)", "value": "b6d4967397159938a48026ce8521eb0d33f3e516c5dc298a57742d905ed36222b58c26475bb1f888cc65efac50eb2805", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632223120, "uuid": "9b36d371-2b5e-473c-be7c-30cf224da69d", "value": "T160A46D22E7907436D2633D38DE5A5778983DBE42291858462BED1F4C8F3E7813B29397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632223120, "uuid": "3f579026-a957-46c0-a701-dc5c3ee5fb84", "value": "e2d1256164a0caaa5ac6b37088580cc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632223120, "uuid": "9eb430f8-082a-43b8-b1a6-c7893fd3e971", "value": "12288:g3kbCPdJ8PdmYte0aSpI9LiZ5nznX7A3j4IKH:CAA8Fm903emZq6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632223120, "uuid": "8415d31f-0a77-46c1-8210-f90bfb4a959f", "value": 449722, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632223120, "uuid": "460fd098-553b-40b7-8991-0f6c5f7fedd1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632223120, "uuid": "57dc2921-de47-4948-befb-156934a81a6f", "value": "test.test", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dba1e925-1ab5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1632212891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212891, "uuid": "48add578-a558-47c1-ac69-482d11a5e745", "comment": "Malware payload (AveMariaRAT)", "value": "42fc03ae24ce7f4d5a216fb3ef014ba2", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212891, "uuid": "df78912c-4d43-4dfa-a111-67759f290bb3", "comment": "Malware payload (AveMariaRAT)", "value": "6593812d8bbcdc1f5ab79ff4ac2ec45c686a3706246fc766ba11ee828d9f7f9c", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212891, "uuid": "eead3c48-614b-496d-9ead-250ae4711b04", "comment": "Malware payload (AveMariaRAT)", "value": "fd87afdd0c8d94aa882b7ea9bd782c5669d054e6", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212891, "uuid": "c39590fe-307d-409b-9225-ba787df7df9f", "comment": "Malware payload (AveMariaRAT)", "value": "87436b0d184308ebd42b8efc23300b2995cc96b4d5bfb014ee0c0409f582165cfe30fb358560b851bbbc7ce6974493b6", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212891, "uuid": "5427a1f9-3cf9-47a8-bbe7-c80c012b6a5d", "value": "T126D59EC3BB3E0007EF276571B14F6912AB94FE39524476AF1B263A9680D31C1B58E74B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212891, "uuid": "adf50ce1-5ccf-41fd-bf0a-8f51d41ecfc3", "value": "6bac3cfe8acb6c6c4a30aaa022de2388", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212891, "uuid": "7cd696dd-422a-4e29-8d36-d99464abe07b", "value": "24576:ssF6mZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eH81L:fF6mw4gxeOw46fUbNecCCFbNech", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632212891, "uuid": "7683084d-e6b1-47be-9f9c-84704a067533", "value": 2806378, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632212891, "uuid": "b6e44b04-27fd-40d6-b3d4-8ee2dfee426c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212891, "uuid": "12002654-7ae5-4874-bfa4-ce44a9523f23", "value": "6593812d8bbcdc1f5ab79ff4ac2ec45c686a3706246fc766ba11ee828d9f7f9c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4f4121c-1ab0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632210733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632210733, "uuid": "336fda6d-f1f4-49e8-b061-6bf4dd0596a5", "comment": "Malware payload (Formbook)", "value": "74a94d6efacfc22d6be7a15de20f1e57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632210733, "uuid": "ae478ba6-bab0-4272-b5e2-a68070c0f2fa", "comment": "Malware payload (Formbook)", "value": "66eaa86ebfd9a80f623d9ca307e0ba4374c56a0af202ab0833d082f92dd101a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632210733, "uuid": "70a8df97-1a05-4edc-a7f0-6d40c7da0052", "comment": "Malware payload (Formbook)", "value": "848d3bf126f6a9d9f6baa765565a3194daf39083", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632210733, "uuid": "e599c871-3900-414f-bab7-915cfd2b849b", "comment": "Malware payload (Formbook)", "value": "26011dd29d39709956625beed976c7935dd77a0a650eacdf5c76581235469ccee00de2e16fbb9844790124f2fa898d4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632210733, "uuid": "1e058baf-bada-4c12-88ec-c9c977560f79", "value": "T160441260D28188B3E9A3F7B5593B5A37F67BC8190204AF0F4F418F774E530E1949A69B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632210733, "uuid": "b684365d-769d-44a3-aa5d-7ed041786282", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632210733, "uuid": "caee479b-6336-443e-9bba-773ef96a851c", "value": "6144:B8LxBmprUKyZdSAslFVYH0eNSHP36zdNX3eOCym:BpgrZuVYUBHiuDh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632210733, "uuid": "813a2afa-ff0e-4ecc-a76e-d875c94cf971", "value": 255443, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632210733, "uuid": "a3c34ef4-1dae-4872-aa01-b51e2a893925", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632210733, "uuid": "ba1aa545-3fb6-45ec-a2d3-6db02ba6bdc5", "value": "INCORRECT BANK DETAILS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e4c293c-1ab1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632210856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632210856, "uuid": "80622854-0dfe-438a-8296-f4560faf0e61", "comment": "Malware payload (SnakeKeylogger)", "value": "f3a50d828d7b3b90d75767dc7bb796ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632210856, "uuid": "7ff7377b-0630-4b12-a027-fd8e77bba928", "comment": "Malware payload (SnakeKeylogger)", "value": "66fa12f36a4474e6abef1c5a0dbd899b7cacca24e89077f150f1771aa3df94c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632210856, "uuid": "6c9fa757-816c-4965-95c7-b034d38e2521", "comment": "Malware payload (SnakeKeylogger)", "value": "e862b727f5d33f2d4c47fa2872a196f80d96038d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632210856, "uuid": "703a14db-69de-4560-934e-0928c421bff9", "comment": "Malware payload (SnakeKeylogger)", "value": "44f923b871b4322716abfd1ad689c40241693ecb061e4a4943a921fa29eb0531c0b2154678d1d489fb6b1e06df1d025f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632210856, "uuid": "29cf8b7c-159c-45d2-ab6f-04a09545ee57", "value": "T196C1B712E7E8873BE1B6473499F383417770B9065A67CB4D34D0521FAE277018A92FB8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632210856, "uuid": "8e1208f1-9dd1-4166-bb01-7757bf758421", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632210856, "uuid": "6f0a65c8-3e2e-42e8-8f6e-30a6cc4d322e", "value": "96:140w4+xWmBJfMNhbhsJ/8lioEMkhKGGzzNt:uTMNh1shMMxo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632210856, "uuid": "6b937a01-39c6-4efe-92b4-7d436ff493c1", "value": 6144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632210856, "uuid": "ce28b894-081a-48c2-b92c-d5076b4f7d34", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632210856, "uuid": "8ef50697-7106-4e29-97e9-11cea67cb1d7", "value": "MIKPRON GROUP-MATERIAL-REQUIREMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39673d02-1ab7-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632213478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213478, "uuid": "73fae13e-2eed-429d-a0df-ecb687d7d4e1", "comment": "Malware payload", "value": "2784c998a43f4aae8c1c5c8bcfd0abfc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213478, "uuid": "f4d28289-0f57-459e-a332-e1c3520940b7", "comment": "Malware payload", "value": "67b0cb83b7a5e9fe25c6e00fa7fc81bcd6e80696a8bc66cf81b218c695f00e74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213478, "uuid": "e26cb298-c716-4943-8d91-70957d17563c", "comment": "Malware payload", "value": "28f6f39ccd4a819cd475318db3dcac749b8f5bc5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213478, "uuid": "b91bba71-6244-400f-ab1c-69953396cb7e", "comment": "Malware payload", "value": "fa3fe4b96d9c87048009b3bced63e8a6f43e5f4821d78b3592ff0bd687c52535f9ac9d55f66a9b4b8a752e325937423b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213478, "uuid": "f4313f0d-1468-491a-86b9-565869529614", "value": "T10A350B38ED0A21B7EBAAD334E4BA150AA5F418BB33349D1EC592774D195370370DA3AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213478, "uuid": "385a2713-4fd8-4be9-a227-ea57569a683f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213478, "uuid": "07249e25-0836-4d17-92ae-d6fa7855f592", "value": "12288:vV6Cn/t5TlOGiWFC2mrIWSc88Z5OjmLvGtOWT4W0n+1tRbdJe0c8bC:N6kVfOGxC2mrI5cJ5O66pC+1tRhQfJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632213478, "uuid": "c8cda304-821b-444b-a808-3a269019a324", "value": 1125376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632213478, "uuid": "4c274d72-cdc4-4ef3-a9ff-1b0353108df2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213478, "uuid": "b58f415f-dfe3-4c8a-b6f7-17311bc5ba7d", "value": "67b0cb83b7a5e9fe25c6e00fa7fc81bcd6e80696a8bc66cf81b218c695f00e74", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03123749-1ac9-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632221118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632221118, "uuid": "c4226a96-32fb-4813-839e-3bfdcc38b23e", "comment": "Malware payload", "value": "c9da7eeb35209ea9a47fcde193e77266", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632221118, "uuid": "0fdd8464-d6e2-49eb-b09c-fed0e7a3dc0f", "comment": "Malware payload", "value": "6861164d09d90910f41f977e32f0d4ecf23441c143b56f3b2a12fdd1d2d8da20", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632221118, "uuid": "593f80de-8c4e-4a08-b14e-c1f80e0b2336", "comment": "Malware payload", "value": "2b7b0947c3f4dcd2f28b87aff2f2c8b821300d3a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632221118, "uuid": "4f874bab-0192-46e5-bd42-d42421ad2b6d", "comment": "Malware payload", "value": "9410437c86817965c57200a03b47b32daccb26c3c07eb613920bdd86186a84f4ec71170070a262cea3031ea0cb5d667a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632221118, "uuid": "41b0fe72-967a-44da-90f3-1c8bfaf19a87", "value": "T1C8F48CA077F89A25E6EE3731F030466827F7F80AA57DD34D9906E4AE1D82B814D507B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632221118, "uuid": "f9d92a84-1a0a-48d8-9875-cea50cf02237", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632221118, "uuid": "2b78c950-84de-46ee-a218-188cece419a4", "value": "12288:XZG+/gecNU2zqX6lUB2AkeR3ACtjm94vD0n5P+MmZZL:pG7DNgWUB2AkeR3APuLWI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632221118, "uuid": "09370f8f-892e-4132-a572-8303ad6e1e9d", "value": 787504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632221118, "uuid": "65aee7ba-2024-4ca8-8201-ce7c6123b3d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632221118, "uuid": "a53fbf56-f3ac-4ba5-822b-81750e654cd2", "value": "c9da7eeb35209ea9a47fcde193e77266", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "998c6348-1b14-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632253583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632253583, "uuid": "5eb7e569-92dc-40a9-bf3d-43ba31ae34e6", "comment": "Malware payload", "value": "710ff8dd9375beacf7c9dff03f6e90b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632253583, "uuid": "19acc468-f5da-46a0-9e12-ed85a061f85c", "comment": "Malware payload", "value": "68f59f9ceb6a93c4ce1cb450202bd0dd021543c5bf60d82f36c86252a5bd69e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632253583, "uuid": "03053e0f-0c71-474e-9270-bbf37d8d27d4", "comment": "Malware payload", "value": "97b88df636884ea96e1e02dda4136c1a0bba2b3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632253583, "uuid": "648aea45-be97-4267-9340-da3683f4627d", "comment": "Malware payload", "value": "8c91f6dd8bc626b7da48481e6b9075f5d0779c2a89dbacee7fb883bcccc74feda916c0446954707ce0cfe66fab8b7a19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632253583, "uuid": "569f26ac-3ca6-4aab-a408-50c7dc06f0e1", "value": "T14A357CD277C8C8F9ED60397EDC49B2812305BBFA7C924D489DF06F8A1670A61B46D44B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632253583, "uuid": "289d3d11-b6cc-46b4-8725-42a51220efdd", "value": "bc8cc1eea5c25ce2056d7da92bd98134", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632253583, "uuid": "518dfc78-5e89-4e8f-b01c-4105a3eece88", "value": "24576:320N/seflZhTmiW3AOuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuc:3tdfU5f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632253583, "uuid": "6f33d037-26bd-46d6-bc93-5cc9f9aad03d", "value": 1133568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632253583, "uuid": "0f9732c9-0630-415e-91ca-6b402b4c4c63", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632253583, "uuid": "093330c0-d59a-4763-8500-a4996ccbfa40", "value": "Attachment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61bdf70c-1ae1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1632231585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231585, "uuid": "452245b3-700e-4a23-a700-b79e052656bd", "comment": "Malware payload (ArkeiStealer)", "value": "d01e4000e77e7a50d1720ac1da219528", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231585, "uuid": "fdaefa05-561d-4bd3-bea4-f4461d0a3b2d", "comment": "Malware payload (ArkeiStealer)", "value": "6937035e02b301f6959cb85c974d4956f2e7880e1d6faebe261b21ec0f200a4a", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231585, "uuid": "c371c7bf-d6f0-44bd-a0fe-9eb780c74a0c", "comment": "Malware payload (ArkeiStealer)", "value": "90a608ef13f55e0263d96be4c5b128288f934618", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231585, "uuid": "9907619c-6802-4b52-8a79-fb1090fd3b04", "comment": "Malware payload (ArkeiStealer)", "value": "c53ca08ae566f2c222e337f489c94e162c64f5f1b2b8f33c82dff90597ee08d90224ad939fb57735a19bc1d315b98d6a", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231585, "uuid": "bf163731-9e2e-4593-8841-a0d432f493b2", "value": "T1EDE4E030B6B1C035E5B782F989B983E8A92D7E71FB2451CB12D567FA5634AE09C30743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231585, "uuid": "971cb1d3-cbe9-496c-9c57-ed55ca7b59fb", "value": "3a5e62b58b4a57118c6dbb55f27570fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231585, "uuid": "e6fbf43e-1d2a-4ee9-ad7d-1d26ffbbd8eb", "value": "12288:3YnHu6UL0vZWRQ2/FivdGnleEuXqliEs+OjPh/zcMo/c5vhoAE:QHeLCTvWlJKEsBjZ/zcMo/YvhoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632231585, "uuid": "152864bf-84ae-4423-9dd9-3185a28cf8b3", "value": 715776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632231585, "uuid": "ed47cd1c-f565-4552-9f89-eefe66fd3fa0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231585, "uuid": "261f9c5a-bbdd-456e-95f5-2aa971a6e010", "value": "d01e4000e77e7a50d1720ac1da219528.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14c54984-1ab1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632210840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632210840, "uuid": "e678ee6d-b756-4f6b-95e3-5ca548801d52", "comment": "Malware payload (SnakeKeylogger)", "value": "319666af1b4391a150ad3a6e854de163", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632210840, "uuid": "c9ba9a7e-08e3-4f11-b036-f74525dc958a", "comment": "Malware payload (SnakeKeylogger)", "value": "6970940c6f449a63ac5a04ad826be1f9236863ca76d040797bf2e8fbf89a6c3d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632210840, "uuid": "3f5529c2-0695-4f98-98ce-29ddd0ce29c3", "comment": "Malware payload (SnakeKeylogger)", "value": "bce2ea42785d482bf250c6b581c263353425fd31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632210840, "uuid": "2b630858-a37e-41f4-ae64-1e0984102dfe", "comment": "Malware payload (SnakeKeylogger)", "value": "927e626688faf194a2847b1b92ade52d040552c27d3fcd58ac25bb28af559cc655d94723804ca472dc1b298182153057", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632210840, "uuid": "5aca93d6-9ef8-4720-a4bd-21a598d96bcc", "value": "T135B423E3E6D0C8F3D2E78B75107E2E6563B5931B406EA50B43647E1A2C315DB8239DE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632210840, "uuid": "f19bed04-fcd4-40dc-bcaa-2a3ede4a9b87", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632210840, "uuid": "92e0b2c4-9ea1-42c1-8a48-f3c0c01fc36c", "value": "6144:X8LxBY4nZPSQTjeUqJlG9r03cjEEdVdWo/fMgtJ2LQPk3nAiPiy0YIrjddazprjF:1WqUqJlk3PdWo9tILHAiiy0Yge9roE8e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632210840, "uuid": "8132f1a0-1cbb-4b40-9b43-34a827d860c9", "value": 521475, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632210840, "uuid": "9a75614b-ba0a-4935-83e0-4c6f877cd840", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632210840, "uuid": "41304c35-d081-4ce4-8dce-5a09df49b087", "value": "254345323-098765567-098770.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6d3640c-1b1b-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632256719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632256719, "uuid": "a86951bb-2b2e-409a-8c28-3a14974e5d81", "comment": "Malware payload", "value": "d883d9c4eb5bbaf4d4b3131d1ec71349", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632256719, "uuid": "76eb0a9a-7b94-4c84-876c-9dcfaef6d60c", "comment": "Malware payload", "value": "69c5c5860dad093aa840862d188c4a17b372bd00a570d5d9831ea6da6e489cf4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632256719, "uuid": "12c3d674-b3f7-4025-ae68-6f2de8ac2c7f", "comment": "Malware payload", "value": "d8e05d80a918947d56b7a410a545bfe3caedbf3e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632256719, "uuid": "9bd4ad22-1d35-4531-915f-3cd25bc91f8a", "comment": "Malware payload", "value": "bea930f75ee0a71f410498c3f704dca54d4b9d9b751ddd254771fc11bf6da243c164ce99c5bbad3a0db9c32230aeba96", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632256719, "uuid": "b34dcd63-7903-4117-bd44-af651c812154", "value": "T1D6C25300F654CD23F2E10A325E6792852539EE0BDC52AA5FAB5B3F0F7DB124C45CEA51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632256719, "uuid": "d42aae74-f07e-4b5c-b5cc-95148ee2f158", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632256719, "uuid": "8b75b165-2807-4541-adac-f8f5c5fdf679", "value": "192:jr/bqE6ZsqtIffTLwN8ElEJc1JHAzmnzmJrRSa8HA+uwPJRhSbiVECqR:jr/b98NiffTLwN1EOHeMKJd4gnL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632256719, "uuid": "2d30cd77-fd24-4108-85d0-33a16ad6f723", "value": 27648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632256719, "uuid": "fc166059-4f7b-4480-b913-3fbaad445890", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632256719, "uuid": "cf7fd0a5-b685-4b9f-9d97-2f9bf833f725", "value": "d883d9c4eb5bbaf4d4b3131d1ec71349", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc5275e1-1b0f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632251493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632251493, "uuid": "463e57d0-5b58-4c97-b59d-e945b1bdee07", "comment": "Malware payload (SnakeKeylogger)", "value": "ce90a936120772c37c808b909a612a3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632251493, "uuid": "bbd431f5-d147-4c29-9fda-60bfebc5b94d", "comment": "Malware payload (SnakeKeylogger)", "value": "69e1e65f93b1939bf2677660efd59acec32e6f340134ea03f5c5abe17682c875", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632251493, "uuid": "341877a2-988d-4a9b-b262-a5b765c952fa", "comment": "Malware payload (SnakeKeylogger)", "value": "0a5bc9bc2882592880d2c12000915752809be1a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632251493, "uuid": "9d7751d7-2b76-4f70-9a8c-c008c4d8fa3e", "comment": "Malware payload (SnakeKeylogger)", "value": "cd408f40c42b0bfb12eef9124e7c1ddb9f8fe8050049483fe895d984750bea4882f8ed228e03fbeaae132b56adae2684", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632251493, "uuid": "02b2ee3d-5efe-4dde-81f4-39f052557450", "value": "T1F4E4CFF32940ABE9D6923EB13479A5500D78BE33BADC31996B81B35C0F7642EB411D39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632251493, "uuid": "4acf96b1-741c-4d27-8142-e905cf58d72b", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632251493, "uuid": "e24ef590-efca-4b95-8200-3c85c1fb95fb", "value": "12288:JwwwwwwwewwwwwmQEv+ED+t1hpZeevdkr3/MNN4VvNRMXLxpkmk6JYC7:Jwwwwwwwewwwww3Ev+txZeosPMbeqLX/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632251493, "uuid": "11cf9574-2645-481a-8b43-1b4b45ce921d", "value": 691845, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632251493, "uuid": "e545ae10-c159-456d-9904-e1f6f3b7f74b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632251493, "uuid": "de57818c-cf32-4e3c-baba-81fa044809dc", "value": "023456789098765423456789.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "203cbd9d-1ad1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (STRRAT)", "timestamp": 1632224603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632224603, "uuid": "15a5f359-98e1-44ca-bc3c-70b6308741ca", "comment": "Malware payload (STRRAT)", "value": "21382ea6e1d17992e1d42860421c0e19", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632224603, "uuid": "af854fcd-d225-4891-bece-7f363db1f11f", "comment": "Malware payload (STRRAT)", "value": "69fd00fa4cce97cebd14ce3c9f3d8ddc5f050c055fdd070d8813c86eaa5a4f91", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632224603, "uuid": "d74deb1f-f5c4-4438-9b63-19c6ce17e829", "comment": "Malware payload (STRRAT)", "value": "a6cd76cc3c37b1a70d9cc5efbc389b3a25238502", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632224603, "uuid": "dbf8e580-b3bd-4c78-be51-3ec1fded2c5c", "comment": "Malware payload (STRRAT)", "value": "119e8079eb9231574bba80dca690c6bc375b0908cc52d3a453e8676fa8e0c1238e40598e19188bc0154fa3835d4349e1", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632224603, "uuid": "a8c8583c-1ac0-4a1a-9114-fafea8e56170", "value": "T165C312ED0E7C592DD11910F3D037955B625EC86C3CD2ACA3B975C9AC07E81B1EC1866B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632224603, "uuid": "c43c1dd5-bc36-4cf7-b332-8a86f69132c5", "value": "3072:9zzDMFD+EcQasO0Q88N4V8zV0FZU8gzYetvLvE15bIHIFEQ6:Jz0mQfdV8Z0jZgUGvLvETbIHIFK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632224603, "uuid": "e1cabe68-ad91-4da7-82a9-c929ff340263", "value": 123344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632224603, "uuid": "111bc60a-6b4f-4cac-a9ff-64e13c4be6cf", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632224603, "uuid": "9a32d4bd-c624-4fd8-af8c-05a9a84eaabb", "value": "Quotation Sheet.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e196b194-1b1b-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632256710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632256710, "uuid": "4210fa05-78d3-48ed-a27d-300423942af1", "comment": "Malware payload", "value": "de964e4eddeb6ff30b6382af77de7650", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632256710, "uuid": "8828b645-b37b-4e8c-aec8-476a424942fa", "comment": "Malware payload", "value": "6bb272687077dd72fd43ff97e4883a202c4a041cccf94b6df1876820d69418f3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632256710, "uuid": "c0df1ca2-49e6-46f8-bdd7-94abe6571694", "comment": "Malware payload", "value": "781708f81b9d1a922c11060e8a494bc8a7471a06", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632256710, "uuid": "adbe7fef-35a8-40e1-b3c3-6b1da2e42a3f", "comment": "Malware payload", "value": "a400838f119060b2642eed6450af7c5d0043271cb9148b0b5f2a1892bfcb4b805225b1d79acca8278f6a45da8630aa4c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632256710, "uuid": "916867f1-e5a8-4476-910c-5ac8101acb30", "value": "T1ED13D406B625CE16D2D54AB3CE6BD1481735DC429C01DA4B374B3F0F7C3339E899AA09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632256710, "uuid": "9ba61392-9fe1-4d7b-a358-332c67fd47e1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632256710, "uuid": "7a9f54b2-701c-474d-8b9e-5e723e587068", "value": "768:m/3VMX7xbLYCQafz+lRPsHbQTg8XjTch:cV+JL/ilRUHbQTg8Xjoh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632256710, "uuid": "cd73bd78-eefe-4bdc-87c4-c5cc5a63892f", "value": 44544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632256710, "uuid": "7f30abf5-3edd-4ed7-9784-7b27a499dd1a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632256710, "uuid": "2737d599-bd73-4bb2-b772-59ffc0f43357", "value": "de964e4eddeb6ff30b6382af77de7650", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "246e67f6-1aa5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632205712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632205712, "uuid": "c1dd28a0-2e55-4311-8240-be0c889d28b8", "comment": "Malware payload (Formbook)", "value": "8d029a307dd67443a5a437b447c323ab", "object_relation": "md5", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632205712, "uuid": "04aee3cd-a33f-4576-ba95-7877155efa9a", "comment": "Malware payload (Formbook)", "value": "6c0e85b84f2b1dfdb580a168386ad91efe7f734066ff3a12a0d359fcb4711dca", "object_relation": "sha256", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632205712, "uuid": "51dc14a8-6365-4efe-bcf4-4c5e8239d576", "comment": "Malware payload (Formbook)", "value": "2c39f2a6df2770fbe890ea094a501fe55f4b7976", "object_relation": "sha1", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632205712, "uuid": "43d28133-7742-4864-a56e-d756cffa138c", "comment": "Malware payload (Formbook)", "value": "ec3883f9ddbe5e0b4ba914d50d1fc8d445530b744cca4db3a4b12dee06f19304e5523ec2d11c768c80bee24a5c8dee83", "object_relation": "sha3-384", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632205712, "uuid": "948ddb78-91f3-4271-85b1-c7515f0a453a", "value": "T1A305ADC17D47D89BF4DF6AB398AFC42011646E8D9161C73D2682BA2B55F3312309BE4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632205712, "uuid": "8b9516d6-3aa6-4139-bd76-e79f22895b26", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632205712, "uuid": "6ed65a68-c7d8-413e-a0b9-d59f17a41b9f", "value": "12288:25MTdtGGtpsmtiK5oyZ3VkwZLVxTwnKBgtlWAh8FCEDpYStqcqvt:hM+FoqFZXYrH8FC6ztbCt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632205712, "uuid": "5b49d603-1d28-47ef-bbdb-130047b4c361", "value": 827904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632205712, "uuid": "0d995666-534c-4bc7-8e41-d35ede96a961", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632205712, "uuid": "0b946501-1af3-4105-8429-0a583cd38ce7", "value": "La lista de carga.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e79ad47f-1ada-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632228803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632228803, "uuid": "eba13ccc-52bc-4ca2-83f8-048cea1581ec", "comment": "Malware payload", "value": "6b3165f51536eeb08ef60f6fcef98845", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632228803, "uuid": "90fefc1f-d897-4855-8c75-d6c1097dd3e6", "comment": "Malware payload", "value": "6c4d4550fcb625d769eba52663210ef37d678d1dae08d6198e34f6cf45bc9c2a", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632228803, "uuid": "fa2d7cfd-9668-4d60-8c41-05d363f717b9", "comment": "Malware payload", "value": "66a6de986e563267ea67e5e00f3443c304b1806c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632228803, "uuid": "3ec55586-aa77-48e3-a173-1de90a425331", "comment": "Malware payload", "value": "72cc25393be7fb6d4411bc8fc8be0e737b343eb65c177164f46ff1065a7140ed5192c566de7118cba54cc94a80f5956a", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632228803, "uuid": "dc03c374-de4f-4a1a-8583-98fe9fa4b2b4", "value": "T12381FB789EAC14C3DF8658BED53A7E650782F0868ADF164C721DFCA12BBF2017656843", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632228803, "uuid": "34fc6d9c-0433-4905-99a1-d75dd15baf72", "value": "96:iWNky8483DV0gww5xlx8+q9MRgVUZixP2goND9TfISD4P+oNqgO:iW+y848p0rwvle+zMoNDVIk4PL2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632228803, "uuid": "06c04df9-d9a6-4632-82de-df024d6f5148", "value": 3909, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632228803, "uuid": "58ee39bd-2ce4-44ed-b953-fc9974c29a8b", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632228803, "uuid": "1d68f595-9a47-4418-8065-c716f3abb48e", "value": "PO_ 02142911.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "068b129b-1abc-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632215540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632215540, "uuid": "be560f66-a4d0-4099-883a-01c40209b17b", "comment": "Malware payload", "value": "7b4cdcad8ab6a42017cd93d9639074ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632215540, "uuid": "d1e3924e-63cc-44ee-8193-c79c7cd13cd6", "comment": "Malware payload", "value": "6cf4d60af4e22f92096f64bdc0be0722ba53f589922c1f171c4c4faac0ce711f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632215540, "uuid": "531e9dd9-aab2-4009-b870-fc8f6ac45f82", "comment": "Malware payload", "value": "c0aa8a511b88c2f5526e103439bec1aa17f06f54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632215540, "uuid": "2efd9f4f-1450-4c9e-8b63-7bf80035569f", "comment": "Malware payload", "value": "65444741344a39269eb369a3f3a0643cdb69d2ef5739df969fa432c950594f321896a605fc697e4dc12e3279e39540e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632215540, "uuid": "595147a9-7061-4494-9a08-38bb262cc4d0", "value": "T16294DFF09FF5B8A4E026207375A4B13C3BD75E0EDC659879F24BF10A36619C221E5A1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632215540, "uuid": "5b515394-118b-46cf-901f-c11fa562d86f", "value": "6144:QbzGq1s9LZikWf8aW673B/AbbnF2pScvt3v+fD0DRdlYw0s+kb1NMLSs8h:u1eLZifW673B+HRgDRdSBRi1iLSNh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632215540, "uuid": "fad76a32-da95-4fc6-ba9c-e86e3a20563b", "value": 444360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632215540, "uuid": "a9f1ba75-24e1-4814-a573-27dc13aa788e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632215540, "uuid": "b3f942a8-cdfe-4f66-b9c9-0c842640ce33", "value": "7b4cdcad8ab6a42017cd93d9639074ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbe9c290-1b05-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1632247251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632247251, "uuid": "07ec3145-a949-465b-8f40-bb25707eb1cf", "comment": "Malware payload (Loki)", "value": "ac1c2279398189a9794341e4393c8ec5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632247251, "uuid": "07732241-900b-4c9f-a239-bf319f864a3e", "comment": "Malware payload (Loki)", "value": "6d75a61f3f6a88549f30abb25ea9e1db4f6b5733fa20e214768a95d6f2150ec9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632247251, "uuid": "88ecaf98-6581-4d83-8778-4272e8d90c60", "comment": "Malware payload (Loki)", "value": "7125fe05b0b5a5d4b486d05a0d80457aa9007817", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632247251, "uuid": "eadacea9-5e22-4341-adb1-f332c0218174", "comment": "Malware payload (Loki)", "value": "03a116a259475e48dd888e92bb3b44c41acb135755a94e7a4303b51136261ad51b77ce6d66cd5efaeae2bca387bc4419", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632247251, "uuid": "d44f9f5d-e2db-4ff0-9378-5461c4b678e4", "value": "T18FA4133DC5A86365C97F83BF213142020BB5E2CABA17E72AAF45F0CD3D1A79911648B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632247251, "uuid": "342cfd74-bbe2-48fa-8677-b608958943f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632247251, "uuid": "e52f868a-0871-4fe4-ab38-a80818c00029", "value": "6144:dt4tWNmtiS3/NpZZaBDnS53448wmg8YWILBcX/jeD4hoa0m5bpONeiAZxF5eEI4B:dt4mmtiK5oBr54QNeOU4hoatVmD0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632247251, "uuid": "adb12ff7-d0d7-4c05-80a0-f5c38149dea9", "value": 454656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632247251, "uuid": "f20c6965-7142-4918-90a0-332c9d681477", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632247251, "uuid": "ab3e8cb2-3901-491e-892a-7cf7c9137548", "value": "Estado Pendiente 06-21.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d69a500-1ae1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1632231551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231551, "uuid": "e5e79d9f-f67e-4e66-9242-5ee6517002f7", "comment": "Malware payload (DanaBot)", "value": "ab61c5bc4c07f29c6da9db1d04b344b4", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231551, "uuid": "6e0ad897-262c-4df1-aa23-0b8c7e949afc", "comment": "Malware payload (DanaBot)", "value": "6dbf6b88440cd8cf8361d0602c6cdbdc38dd05f9ffc9fb1547986c674d6dee66", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231551, "uuid": "8195b936-36c9-410b-97b6-cc3e60e846e6", "comment": "Malware payload (DanaBot)", "value": "e0ace4cfb6e2f2e5d190955259d07168d4b889a2", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231551, "uuid": "78c865d3-f46c-4a6b-a735-a31569f512e0", "comment": "Malware payload (DanaBot)", "value": "1f62d193f8c451388b519fd9cb317d456b4c0776a899cd3e00aa41439bffe966b9fddbdd67ec0f215f37148b11748b01", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231551, "uuid": "4d26b326-cf67-44f7-8332-5aeffe5e9d77", "value": "T116451210B6B1C031E1B785F5497A83A8E83D7A706F2850FFA2D626EA62347F59C31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231551, "uuid": "b7ea6441-f749-43b3-aeaa-0f2bac99ed44", "value": "3a5e62b58b4a57118c6dbb55f27570fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231551, "uuid": "610202fe-9f3f-46c0-8e9b-115038d17af4", "value": "24576:m8OLE0yxvUfrpV+z9+DPHDNH9CeqG6n//z4Borx1ESUS4080:VSzH+UDfhH9j6n//z4Bix1Eb080", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632231551, "uuid": "5c8a1677-b1dc-4b52-b8ca-4691d036d446", "value": 1193472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632231551, "uuid": "0bc5307b-cc9f-4f36-9793-5bf2b64bd341", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231551, "uuid": "a373ea3d-898b-4ff8-826f-3d8c16a63ea1", "value": "ab61c5bc4c07f29c6da9db1d04b344b4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc60507e-1b11-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632252379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632252379, "uuid": "5c09b42b-346f-4cea-8e6f-68cd9ca4348a", "comment": "Malware payload (RedLineStealer)", "value": "5ee187036dfa9186004738b99c2b178f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632252379, "uuid": "84d51ffb-12a4-453d-a143-6265ea33b2d2", "comment": "Malware payload (RedLineStealer)", "value": "6ed5c2256aac5654f708b39f82f40f29ebab155e0e7fd237db5d70903a240981", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632252379, "uuid": "e5ae1786-8560-411c-a604-b294f0bb3dd2", "comment": "Malware payload (RedLineStealer)", "value": "d0f50ef3402295dec4cd0dbdefc6e041b0cc854b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632252379, "uuid": "669ce3f9-fbb1-414f-9b50-a46a58dd8a72", "comment": "Malware payload (RedLineStealer)", "value": "bf8fef7e01990ea7a59b273f545c6117f1107ae021eeb127bc856d3301a2f8fca84e8076168a86c7abbd682ba73a5850", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632252379, "uuid": "a23a2054-e05f-4c4b-9423-6b1e0b2f84fa", "value": "T1AAD412413590C6B5C4A346317B30E6E1BAB7B92259B783473712662DEF302D0BB7637A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632252379, "uuid": "03a828eb-b5bf-43e5-a466-505edb02544e", "value": "98349bc8fa025f57a9d49df3092c15be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632252379, "uuid": "efad4ca2-2cc9-4fb0-a643-facd343131e4", "value": "12288:cXQIrK0zEDXswNYUpVhAWdJXNw2otMQtHuCG8RgSA5EBaw:cXQIrry8wbVN0G6gb+1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632252379, "uuid": "b85b3490-4545-4d60-9407-3fd283c2af4e", "value": 612864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632252379, "uuid": "8c65dac4-f1cf-4ce1-876f-534680e97a63", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632252379, "uuid": "af57ccb0-7222-4154-9668-4b45265d7241", "value": "5ee187036dfa9186004738b99c2b178f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1cce06e-1ade-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632230484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632230484, "uuid": "5287736c-2a62-4bfb-930d-793efd9ef43b", "comment": "Malware payload (AgentTesla)", "value": "8f04086fea298263f8d172e240bdd668", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632230484, "uuid": "3e22d9a7-666a-4a06-bf5e-432c38f80869", "comment": "Malware payload (AgentTesla)", "value": "70a95a4f9d14e1eba560bf099472de80894b047dc943c8e451e84d0e60eac587", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632230484, "uuid": "ef295fb9-4faf-4f46-940b-03a6ffd63894", "comment": "Malware payload (AgentTesla)", "value": "4d6a59b713cba9ec8649711bc9b9334d1c1a02dd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632230484, "uuid": "a073b9c8-86ea-4d3b-a346-fbee337b5526", "comment": "Malware payload (AgentTesla)", "value": "e0f85e55215029013ebff4d118dec0dab553bd54f8d3d99d8a12192dbdf95e7bfba93f19c5ef3e81262b762afbd9e0e9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632230484, "uuid": "eee695de-7534-4698-9648-a3540c28269b", "value": "T115E40142316E4680C7DA377511A693617B73BE7A6473CA4E1ACC7089CF372865E36F22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632230484, "uuid": "bdd927c4-a7e5-4734-be3f-ef15fb351f38", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632230484, "uuid": "7622c737-cd68-4a3e-bda4-44e1bfd008e7", "value": "12288:A+Ibw8eGGmtiK5oQL5pR2n6PuF+NSDpLGSVoEb3rAmPHnEbF+R8m2Ype:ubw8eGG+FoS7wlF+EdGSVoq3kBCVg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632230484, "uuid": "8981a193-8626-4b62-ac21-d1c4c7ea12f4", "value": 689664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632230484, "uuid": "6f99fede-cd6b-4dc2-aee4-3400c8429139", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632230484, "uuid": "55a9cbdc-2876-4a74-a456-2655b673cca6", "value": "Euphoria Apparels Packing List.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0028f5cb-1adf-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632230562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632230562, "uuid": "808c144d-73ee-4d21-a260-62385ce0bb91", "comment": "Malware payload (RedLineStealer)", "value": "8815f3ea33968e5015406ec171304a02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632230562, "uuid": "290c8f2b-51e5-42da-8b73-53d2af4c4215", "comment": "Malware payload (RedLineStealer)", "value": "71f8415c24040b573b4852f93ba4df25f83f2a57c536ca9b19011b6ceb9c4528", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632230562, "uuid": "5c96c63f-e72f-4397-b367-0dfdea257833", "comment": "Malware payload (RedLineStealer)", "value": "152f5e263c8092c27fa2df32663be603a4ed5531", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632230562, "uuid": "04fce90e-4243-414d-9d71-9d3ea28e747b", "comment": "Malware payload (RedLineStealer)", "value": "ed8f741e70ae8f1b14970ad445175786b9bffc743983214cab554660b2a47577a363058b9c7c5af9d50ecda6c787e4c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632230562, "uuid": "daa198f0-8993-4cc5-8c1b-854fc9ac1ae8", "value": "T12864E0233670CA73C56312304B61DBB16E66F86F5970934727967A3EEF342807B66316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632230562, "uuid": "54632f47-d9a4-4a92-96b4-b6044843803c", "value": "019bced73b51911db702af2d47c34cb7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632230562, "uuid": "93e17182-da4e-4ad6-9615-af18a8fd5423", "value": "6144:EgH+FZTlJuSI4BETXKm71fQaHATp5qjeBwjtw:nH+FZqSDBEJAFHBai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632230562, "uuid": "f8625b45-c07b-4010-92ee-1da5e41aafa8", "value": 311808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632230562, "uuid": "5efb84c1-5523-4712-9d98-ec4abb4014e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632230562, "uuid": "edb4c560-4956-4a90-8b1d-3ba51113b61d", "value": "8815f3ea33968e5015406ec171304a02.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e34b30b1-1af0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632238244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632238244, "uuid": "f40a4a37-5fd4-458b-a71b-ffa9731f459a", "comment": "Malware payload (RaccoonStealer)", "value": "dabc2121c0e66e7547e6d7d69b5eba95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632238244, "uuid": "4d611822-798f-4998-9332-4740b32f486c", "comment": "Malware payload (RaccoonStealer)", "value": "726b323eb5c1c2ae7928f60d7002b3b63b4a69158347686d17789eb0e86fd768", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632238244, "uuid": "49456910-fdd0-427f-821c-c5187ab861a9", "comment": "Malware payload (RaccoonStealer)", "value": "a73378dca88646123202d3e9cb83f74df3d56b31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632238244, "uuid": "0d6da79d-8cb7-4184-92ec-b23d16c1b6b7", "comment": "Malware payload (RaccoonStealer)", "value": "902ed293c661566bf6357434cb7d0164a13b364ba97836ce772d4953c63cbe1cf6db29d48e4ff85cddc5d03edcd4ac59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632238244, "uuid": "b85be871-85ae-45be-9639-d99ddf0fa4b2", "value": "T14CB4021035A0C672C78F96704B64D6A05B7AB9262A7097573A37337FFF24290732B35A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632238244, "uuid": "cb291260-59ed-4ffe-aaab-fba128bb525c", "value": "b4a5f131bf57e0871ab3cda52113b279", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632238244, "uuid": "feccbf4f-c4ce-45be-80eb-6578a0b821b3", "value": "12288:d5nAy0Y/ldBcVGy4BneLBw2B60kjLeYcHyJjA8iXTBai:fAJYt0Vb4BnWS2B60bYcHyJ08iXTh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632238244, "uuid": "27a11606-8b39-4abe-96ff-36ea9db5af38", "value": 497152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632238244, "uuid": "55e572d8-4b4c-48b2-9936-f89103dfd4ea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632238244, "uuid": "3595266a-e4aa-417a-9c7d-e32334a28767", "value": "dabc2121c0e66e7547e6d7d69b5eba95.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08fe1ac6-1b0e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632250763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632250763, "uuid": "3c07caf4-c5ed-463c-a6a0-6066167878d1", "comment": "Malware payload (RedLineStealer)", "value": "88eeb849230e1a59ef175b4087899203", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632250763, "uuid": "6f643cbe-a86b-48f8-94b3-c7b282fb3094", "comment": "Malware payload (RedLineStealer)", "value": "729439c4ee7b6b04bd443520adfae3c5b2eb69981319547e21a9060d64be7693", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632250763, "uuid": "748b285e-b2bf-48fd-93de-b742b41d5d22", "comment": "Malware payload (RedLineStealer)", "value": "e775806ba61dceb0f504a24fb63fbe41cd9cc892", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632250763, "uuid": "26bffe3e-1bfb-48da-a17b-a6f36199fd14", "comment": "Malware payload (RedLineStealer)", "value": "605a30de1992cfadb2c50a75bdb1b42dbd88983d5fec025ef3eb520d2fed60f7aa4c10f7bf85e55ef95d0a490d78c7a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632250763, "uuid": "e9a223e6-8cdf-443d-bf46-fe912261877c", "value": "T17964E0013660DB39E9A795718B30E7E21A3AB9215D70874B3767376EEF303807722796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632250763, "uuid": "d3acbe55-fff5-4b7f-8e17-c2c2a81508b5", "value": "98349bc8fa025f57a9d49df3092c15be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632250763, "uuid": "2c23f1f3-1fb9-4f05-ac8d-af7e4adbfa2f", "value": "6144:SyLphpS90LqoooCi9ZAbWATBh8YBwjtw:3FhpS90moooCinAiAFh3Bai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632250763, "uuid": "1cfa1e28-58ce-410f-b590-3fe0c812cb48", "value": 311808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632250763, "uuid": "4001a334-1bfb-4af3-b878-e03da87578cf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632250763, "uuid": "a14aece9-706b-41ab-ad11-93c15fd2a87e", "value": "SecuriteInfo.com.Trojan.Win32.Save.a.30178.28785", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e60869a1-1ada-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632228800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632228800, "uuid": "24c6d08c-bbfb-4d61-98ad-62f458ceb483", "comment": "Malware payload (AgentTesla)", "value": "81b22f7b7ee081fa82adddf2cd61a0d1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632228800, "uuid": "11bd614b-542e-4376-9dad-17e6a837a01f", "comment": "Malware payload (AgentTesla)", "value": "729f20408786691df49a0dbc47efd36783b1ffe71ac94dbb6811512979f8fafe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632228800, "uuid": "2247a448-113a-4e8b-97f4-5202c1480c8b", "comment": "Malware payload (AgentTesla)", "value": "aa2f1ee24b812f886278e5a16a9e599bb3ff3c72", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632228800, "uuid": "e7b2bc39-9939-4363-90b2-03b0fc77d5cc", "comment": "Malware payload (AgentTesla)", "value": "cc5c8e5f6ea0cdb79d47d19cd73e0adc00f96874582635ffc745f52e09a97d826a16a3037af281c9510c8c9ae0d6edfb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632228800, "uuid": "a46ea4ca-d6fe-44f5-996b-f8292d98da47", "value": "T103340DE4688F44B2E6498C5DA494B148AD74FEE334CA887153AFD435DF59BF2AEC4083", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632228800, "uuid": "d4cc28f5-618a-4451-bcec-a2f9178a8fd3", "value": "1536:izFHYWB6IWEp6aSJIOA0RoBNJTloJRR0ss2wdzFz76mAg5eeVhMDw5wfL7:izOWgv6ss/dzFtr5RDAw5wf3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632228800, "uuid": "2ee67971-9184-4a29-b621-5245114d47c9", "value": 247316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632228800, "uuid": "d2b5c8ac-d33b-4d4a-ad24-0f3179525667", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632228800, "uuid": "45ef69fb-a407-48a4-a87e-d21ab8383f49", "value": "OOLU2032650751.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b96986a2-1adb-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632229155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632229155, "uuid": "14ea2bb8-24d7-4c46-89ea-ac005e76c9a5", "comment": "Malware payload (AgentTesla)", "value": "1d2bf9061da118b660278eea27be9435", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632229155, "uuid": "d89e821e-3993-41af-a1dc-ef76c24472c2", "comment": "Malware payload (AgentTesla)", "value": "7346afd2b8792684ba93e813b031cf56f3680b38356b707a3108d1263b3c8d72", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632229155, "uuid": "055eaf84-03df-4850-a4cd-928464e8e4f7", "comment": "Malware payload (AgentTesla)", "value": "2f0407382308d93c5b8a609f90fe0517282b1749", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632229155, "uuid": "67adf0a1-77d8-420d-b139-c3aa8619da2d", "comment": "Malware payload (AgentTesla)", "value": "1f1b3384a045f22aed0468c743faf88afd009855b4689f81a7540a1910ca9c34d349e1f811e078a993a333c855df6fad", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632229155, "uuid": "b85b29d0-8b49-4a8b-af70-23f46b34eeff", "value": "T127155D394D2682F787EEC66CD04C1BCEDAA6A4C37B919F1AD496D7C2025B70FE48845C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632229155, "uuid": "fd26cb62-9a01-470d-a24d-c53817ee5e11", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632229155, "uuid": "1027ed81-5e62-40ce-9b3d-10a9ef61e2bd", "value": "12288:F9yh9pizW1iezihJ0+GUfvol9E6Y19ChCd:F8pEWh2hW+GU+9E6f8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632229155, "uuid": "2c63b18a-fe3b-458b-b241-e0613f0ef07a", "value": 876032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632229155, "uuid": "023e6ac1-ac15-4acb-966f-79d0fbbb1e85", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632229155, "uuid": "afeb6e08-a593-4b0d-ab85-d3167f95eb25", "value": "Details_________________pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e81be3aa-1ae0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632231381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231381, "uuid": "00ebdedc-799c-480d-8e49-070522838c1c", "comment": "Malware payload (AgentTesla)", "value": "3a1e7f54aef6efa1bc4eafded1d71c6f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231381, "uuid": "e4b2b304-e7da-4f2b-9ba3-6f3d5fb0abb9", "comment": "Malware payload (AgentTesla)", "value": "738fa29b4302facc7e2c853981db6bdbb234bc697cf44df67748628ebac96ae4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231381, "uuid": "8433b9a0-5aa2-4ba0-9c6d-61f73226a329", "comment": "Malware payload (AgentTesla)", "value": "9238ef27d88e679b5d3a2e4ac3147072e0745b5f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231381, "uuid": "09713d0a-f943-4e63-827c-e650ff86ea10", "comment": "Malware payload (AgentTesla)", "value": "05a4f147df2f31885c196ef5116bd095285c3a019b496a6c10ef6caa0bad89d5be8f100302dcba99ecc0afa511bffe7c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231381, "uuid": "f3f4f0ee-5f95-4268-93e3-b8f1d07bb21a", "value": "T1DF157A394D2782F787EEC66CD08C1BCEDE66A4837B919F1AC492D7D2025B70BE49845C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231381, "uuid": "fd23bd86-ef89-4ecb-90a0-b024b671d118", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231381, "uuid": "59c00dc5-7fc1-4d9d-bb17-b6260a13ea71", "value": "12288:bGbJbQqfy+uwqMSXv2ll7xU9ACjMA086Q:GyvrbIxD7A08v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632231381, "uuid": "a0e314af-c19b-4c15-a185-1ca15a567a4d", "value": 878080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632231381, "uuid": "9aa63f3b-13ca-4cd5-95b0-6206c5ba4a39", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231381, "uuid": "4c83e0b4-b792-43ee-a5e3-c7231337bded", "value": "01_extracted.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49701233-1aa4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (GuLoader)", "timestamp": 1632205345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632205345, "uuid": "b7c150d8-92ae-4e24-9f51-2e6fd147d73a", "comment": "Malware payload (GuLoader)", "value": "a5630cd6a56b2fe4b61eebe2278a65fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632205345, "uuid": "b9cba1e8-43ed-4b6e-819e-77b2abc26968", "comment": "Malware payload (GuLoader)", "value": "73c72c61473f43ed03c6c1ddf16b145acd3c9452fc53e07b5d7c32d22715fb09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632205345, "uuid": "0e66afcd-8fda-4a9e-83a3-5269d304d3d0", "comment": "Malware payload (GuLoader)", "value": "78c87d6231e67f05d3894552855d9353cc7c443d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632205345, "uuid": "5183ba26-c0ee-417d-9646-7623069a88b8", "comment": "Malware payload (GuLoader)", "value": "aba032d89f41ed8ec87d8a58c514c0a28e84cbdd9bf4ca60d07fdcbe0ddf0cb70d022cd554185d043955193ad888b9d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632205345, "uuid": "6f56d931-fed4-410d-be82-fc2c1ca6d649", "value": "T10644D34E6B11C6BFC44640BCC416A4F4EE0A7DF2DE4C1AD73A8ABE1935F16624DD321A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632205345, "uuid": "74a84a75-0301-49e8-998c-6e888d0cf1f7", "value": "11a00611c6d9925f25fb400b1faec65f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632205345, "uuid": "de9b0fb3-0d8a-4ea9-be16-776eeb0eb9d5", "value": "3072:CDI79G9E/szjp0DdyB6C26rPKecLe9G9SDI:CDI79G9E/szjsdv/WPKvLe9G9SDI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632205345, "uuid": "08bb2e94-7ccb-44f8-a366-f7b1345ec6a1", "value": 262144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632205345, "uuid": "03a6a096-a417-429d-98fd-b7f209956357", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632205345, "uuid": "9c6aa89e-7755-498c-b5bb-5b2b5ab6ba77", "value": "Ordine Nr 21015270 del 20-09-21.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62462b09-1ac8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632220848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632220848, "uuid": "a8af9bf9-a061-4d75-8125-1a6af97d774c", "comment": "Malware payload (RedLineStealer)", "value": "a74d8695a741f5dd6f4384b52743387d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632220848, "uuid": "98082f43-2040-426a-8bf4-2eebb92fb095", "comment": "Malware payload (RedLineStealer)", "value": "747fbc85901d519c93cde42db42203dcc24aa5b09eb35f8313b9f98f89a14cdc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632220848, "uuid": "49ad4a59-93a8-4d76-abe7-15a9e9be0d0f", "comment": "Malware payload (RedLineStealer)", "value": "dc103af467f4302bae152d803cea6cc632061180", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632220848, "uuid": "c7d9b5b7-aa8d-42d0-885c-6dbe675d2ab7", "comment": "Malware payload (RedLineStealer)", "value": "c161c266f1e2ae5b5a5e1863c662eba78f548dcb517dc0390c5a192df174882d19b1f0ea082062e4352e47167898118f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632220848, "uuid": "4a990353-983c-48c5-80d5-0226844556a6", "value": "T10564CF2503E8DED6C5BE4BB670A1E1B54AF4806B2921EF13DCC195FF1E66FC62980136", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632220848, "uuid": "de6f16c9-211d-4e35-8a7f-a0ae7827d315", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632220848, "uuid": "61715f23-efb3-4238-9674-f18ac7c38c6e", "value": "6144:MNuiQy7FHEs0A3J1AEY9xFSR31FZOo70bBq0rtjRBBWu0Jb:ortDYzo70U0rLBle", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632220848, "uuid": "b98259e8-2987-4fb8-95cb-3c16829404dc", "value": 333824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632220848, "uuid": "4f8943d8-f0ef-4ef1-9806-849121c44e5a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632220848, "uuid": "8a26cccf-b84d-4200-b0b0-cf0d4c645bff", "value": "a74d8695a741f5dd6f4384b52743387d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9a6d82f-1b18-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632255408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632255408, "uuid": "ecdcd02c-b7e5-4142-9ee0-f848392dafa7", "comment": "Malware payload", "value": "659ec740f2e2a6176590bde7295ba207", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632255408, "uuid": "1b014880-4335-4410-a457-a335415eadb6", "comment": "Malware payload", "value": "74f865ab5c9bdf09c402dfcf15248355aa5f743a7d5b4fd64477a1df1ab3bd17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632255408, "uuid": "240cca7e-9465-4030-b475-9ed5dd9bcc3a", "comment": "Malware payload", "value": "f2b74fecce0344c2c7feb8072f638aed006b4fa7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632255408, "uuid": "19b2358c-ab8a-40e9-abb2-55e077d80be1", "comment": "Malware payload", "value": "713e7559056374f5df23218ac19d3c1ca7ee0c4ba432fb6e140897cf613a0b2bc62d058772e9b8668b7e8e8164a21818", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632255408, "uuid": "72403715-6377-42f1-a934-da073e3e5c28", "value": "T1CDF38CAE3614ACD9E8A5A670C8E4CCBC00667C1A27588F4735D37FCF3A32AC95766057", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632255408, "uuid": "8bd5b00d-d864-465c-b837-9968dd1ba74a", "value": "b40f5a9271588e785bcd6276ccd6b52b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632255408, "uuid": "17c8ab4a-4d8c-4ad7-a576-46ad2edfcd4f", "value": "3072:5yvLg0bVPgfXdbD8bcGc/QKsmw8t2jRV/myGvXx9TI:8jDbE+cG0xtqg/vXvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632255408, "uuid": "c2e76095-2388-41d1-a8dd-2a8e7abcc7e8", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632255408, "uuid": "90d99438-730b-489b-9e27-d8ee288c9e56", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632255408, "uuid": "d0f993f0-d0cb-4d5a-8ed9-822292189166", "value": "AVAILABLE CONTRACTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1d0be22-1ada-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632228820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632228820, "uuid": "c895932c-2775-4efd-936c-49c5af5faf63", "comment": "Malware payload (AgentTesla)", "value": "ebb7c9a948d9df19477ca4062c66c577", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632228820, "uuid": "61658974-6013-4755-a2e6-92305a344fb5", "comment": "Malware payload (AgentTesla)", "value": "763b95c4ccc9ffb0897d29203e9c89322d68a7c1ec971152a0d1224895045c9f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632228820, "uuid": "b5a5171d-6a7d-4fa7-a21b-9f7e15d28c31", "comment": "Malware payload (AgentTesla)", "value": "d2ff688af051a354da8a47605efdda62f3b16eaf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632228820, "uuid": "0da6f066-f988-4103-9f52-bd699997b966", "comment": "Malware payload (AgentTesla)", "value": "83b0c0a35a26fd1df64fbfa330b542169640f86c262c4c7556d4f8b42266e22bb373fe138c35a1c63409876e1b500b56", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632228820, "uuid": "7a0234e6-2b61-4c85-bb0e-6684c586703f", "value": "T1B8C4F1002CBEA69FF28AED757B438EA83509DD2A5380B755F44EF57D387D41A0AACC11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632228820, "uuid": "e4ec6aba-63e6-4f0f-97fe-fdfa6b1b1fcb", "value": "12288:GtaAQTN6VCD7NbVG3mytgPdsuztnqtcIrh8DJeQc:yaGJmytkktJr0IQc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632228820, "uuid": "31df4c76-8900-43fe-aa26-bd15c06b2cae", "value": 563784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632228820, "uuid": "55434c3a-4bd3-47e6-96c2-687625eaea4c", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632228820, "uuid": "27b2ee07-c918-45ab-93e7-cc64dfb86d3e", "value": "PRESUPUESTO.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efa24e38-1b15-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632254157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632254157, "uuid": "25846f68-5afa-4335-878a-759d056a56e6", "comment": "Malware payload (Formbook)", "value": "1d7190af1a56d41fc029075d847bbbe7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632254157, "uuid": "119d9eeb-94fe-4f4c-bdbb-7939b08b3f29", "comment": "Malware payload (Formbook)", "value": "768252369536d1e56aad57c5015925ec464642d13d76468db72e60f9ac4e1a54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632254157, "uuid": "c8da6518-c8f4-432e-aa92-171230d9138d", "comment": "Malware payload (Formbook)", "value": "c503a2e9d7f8077f8d4a7d0fbad6d6a045c3eb57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632254157, "uuid": "4376eecb-4695-4078-a20f-2f588e5e8d69", "comment": "Malware payload (Formbook)", "value": "6d1c1dacdb1b144cce3bb308f408b1720f060663bebdcb274c88891f6f7fd2bef7185db2b6b5fe00473c0e8706e161fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632254157, "uuid": "cbb78c02-b2c0-45ce-bf42-4b602313ca14", "value": "T193B41238463AC531CE7BE3BE14B250460B71928AB907EB9AAFD9B0CD7F1A754541CCE1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632254157, "uuid": "b3ff06fb-7a53-495d-a637-735c692d57e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632254157, "uuid": "bdb6c237-3f30-4fd2-aa76-8228311a04b2", "value": "12288:pAsd2/jktuIimtiK5oBJIFnTvBBBP08jwd9JE:k+FoBJIFTvBBBjiM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632254157, "uuid": "16292cfd-35d0-461d-acdd-2d0fbc5e9baa", "value": 514560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632254157, "uuid": "15bc14f2-edb0-469d-87d7-3f49b367b701", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632254157, "uuid": "5e7b5b21-a3cb-40a5-aed8-363403041a9a", "value": "Quotation & Sample Designs.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e540523c-1a96-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1632199593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632199593, "uuid": "46200048-d88e-4184-b5f8-0052ed7477be", "comment": "Malware payload (ArkeiStealer)", "value": "b2f1683e21cd12021af7ef3e0eef7674", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632199593, "uuid": "8957bdd7-9e8a-4359-9717-59e239a4f4f8", "comment": "Malware payload (ArkeiStealer)", "value": "76e3372675b50861ba373f9700db718087d9821cc619e00aca03912f22eeedd1", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632199593, "uuid": "23e95d54-169f-477a-ad53-fe0d7df428c6", "comment": "Malware payload (ArkeiStealer)", "value": "39ec0e7d50737549dab38a48d3403c4177912274", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632199593, "uuid": "bcefdb6a-d9aa-45e9-ad71-c3d4d2c4117b", "comment": "Malware payload (ArkeiStealer)", "value": "0c4240edaaed681de42e898351ed554c16215aa68cff944924652e9f2928790229ee417c8ebdf60d1421e4cf3a778974", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632199593, "uuid": "3250c5bd-3632-4b39-a8a4-345247dde4f7", "value": "T1CAE4F120A6E1C035E5BB12F95ABA93B8A93E79716B2454CF63D517FA17303E89C31703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632199593, "uuid": "2e530163-c4f1-45eb-b21d-af471bb9bdc7", "value": "3a5e62b58b4a57118c6dbb55f27570fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632199593, "uuid": "e6651a9a-d1e9-4b42-ae73-ec93302268fa", "value": "12288:sidUngMLvvVsFly+W6uX9nYXUu4HC9nqvwW/e1OUpm4I+i94o72UaZPNRmV4D:vURL2WxEUHC9nqv2GivusBNRmV4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632199593, "uuid": "173e6af1-2ffa-4dc0-b052-707861af8cb7", "value": 715776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632199593, "uuid": "7a96e943-9ef2-49ad-a1d7-e6d409fb964c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632199593, "uuid": "3e18a034-db3f-4dc7-9cb6-8bdd9873f692", "value": "SecuriteInfo.com.W32.AIDetect.malware2.1853.24511", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b53aef84-1ad7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632227430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632227430, "uuid": "b0b20e77-1b12-41bd-bd70-05f12b47f050", "comment": "Malware payload (Formbook)", "value": "312f6a44979c49a16ad62711ed4248d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632227430, "uuid": "c9c66d02-7473-4725-afa3-14d9770f706f", "comment": "Malware payload (Formbook)", "value": "774c08451198a951fa73f9859b5e48c12c5df9214759e4717e56d92fb4c09d1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632227430, "uuid": "6b12e74f-f949-49a7-82f0-ec03f82365c0", "comment": "Malware payload (Formbook)", "value": "251dc32580d36ee96546b8e99b09244fa31665a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632227430, "uuid": "51d9106d-31b6-4d7d-9ffd-4191e0416e16", "comment": "Malware payload (Formbook)", "value": "e1484c9792b5897612dfac7da3fb76d11058a7122891983ea6ef3a9852a04cef6a3cd78b3084dc6b1af45cafbb7527b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632227430, "uuid": "98a31042-12e7-4af2-b197-e7e227e24b82", "value": "T1FFE4DF89351476DEC647EA3289986D60FB607C7B530BD20FA09B319D9A3E587CF341B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632227430, "uuid": "ccca4778-db05-41a4-9a37-09b87d2e4e89", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632227430, "uuid": "cf2d5338-c7c8-439a-8f23-47f12918ba6e", "value": "12288:cxrDHFd51Ibw8eGGmtiK5o4R7MhIOxf0emgX3EL88Yf2BrFyWRtE4uskMl17b6qs:cxrDXAbw8eGG+FogMqOxcemeHbf2BgWE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632227430, "uuid": "c868302a-a196-4059-8708-434cf830241f", "value": 671744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632227430, "uuid": "15d6a474-425c-47ad-ae88-1ac8e66b760f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632227430, "uuid": "d0490f65-c053-4646-ab94-a99bc658cab5", "value": "Statement of Account.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63a277db-1afb-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SilentBuilder)", "timestamp": 1632242755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632242755, "uuid": "994995b7-64b4-4f9d-aa63-84c46c1f2cfa", "comment": "Malware payload (SilentBuilder)", "value": "5835a2d8b6125cce366a967394ffcfed", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632242755, "uuid": "f26e3510-f016-4767-b978-a7762a5533a9", "comment": "Malware payload (SilentBuilder)", "value": "77b29321c6e985c5c963b5fc149b124bb78f5f5a3ee92253db25cee88445f20b", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632242755, "uuid": "29b54dcd-003a-4f30-9964-b63554b45da8", "comment": "Malware payload (SilentBuilder)", "value": "148f1c290b52d29e0745c7d99f922adba33ed192", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632242755, "uuid": "31c0e479-bdfa-4c81-91ae-e4b135dbf6a4", "comment": "Malware payload (SilentBuilder)", "value": "da4dfc60d230ca3660ae8c7f956af739c76adf7000b77ec9041e50a69f2a04f6e17fb2c3b45ec6182ac462952f94b9e9", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632242755, "uuid": "527ad328-9cff-428c-819b-ba16274e92cd", "value": "T18844D02676A1641EEC2D2B76A4BB53E02337FC404FD38BC76AA772223F729D14D26505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632242755, "uuid": "1d72af8b-2f67-4ca2-aaf0-3bf74087eeb0", "value": "6144:jKpb8rGYrMPe3q7Q0XV5xtuE8vG8UM+RnfzLI6+tqD2EwnoR57lj+QSGxGvJmmm6:kbD6qyEwoR5lTS/cJ3nLQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632242755, "uuid": "117193bf-c4d9-4c52-a61d-78532d94557f", "value": 270336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632242755, "uuid": "b13d72ba-611d-4cda-b450-24ba686e203c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632242755, "uuid": "82fb11c5-bcd6-4aac-a7c6-3f53dbcb83b1", "value": "waffle5.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "143043bf-1b28-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632261949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632261949, "uuid": "24d12d0b-6d98-4a07-83bd-2313a70a4b2c", "comment": "Malware payload (RaccoonStealer)", "value": "70afcaea3770a4c1b3f8b3b49bed6a31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632261949, "uuid": "9c249c62-9b42-4c73-9704-10a9929511c5", "comment": "Malware payload (RaccoonStealer)", "value": "77cf253139da7813ef65bbc083d1369e8f2b62a5328aa34aa0c7e490a5686af7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632261949, "uuid": "7989ebdb-0713-48fb-9261-31f3c915a016", "comment": "Malware payload (RaccoonStealer)", "value": "e7f287217bed83430d9f4f261b4141b1064593f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632261949, "uuid": "95bf9ddb-d00a-4f7b-994e-04827c7ca647", "comment": "Malware payload (RaccoonStealer)", "value": "c399d8d2fb7cc729a3b246d05a2674175b9fd07baae07d3b9489e13c2f908baaa4e7a32380badda90878b958b719099a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632261949, "uuid": "693c2be0-0dac-4d70-8fd6-14f432986a63", "value": "T1CBB401017FA1C671C6938134483DE2E07276F851F770DE9B7BA6FA6E3E726804622217", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632261949, "uuid": "8bdedc85-8050-43b6-9aa5-6d65b3cb4f88", "value": "b423274974f58a1d1a63a5242c6dcf99", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632261949, "uuid": "c6c459bd-462c-410d-9f98-e6cd1aa593e8", "value": "6144:zDzMEQ4Suw7lEeWrczrG7Bo+QSpgxvsX9j0cZM5Vbft+Se/fQ8TGy38o4g4F1UBL:zDNSbKDm+QSpNV0Z5VrTUIn840Bay", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632261949, "uuid": "9e7b4a83-f49d-4f3f-b443-ed85ad37bc34", "value": 500224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632261949, "uuid": "9fff17a8-1465-4019-91b9-da2606c74e2e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632261949, "uuid": "c1d63fc0-e47e-4fd4-bd11-c2f5834a1f9d", "value": "77cf253139da7813ef65bbc083d1369e8f2b62a5328aa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74d749f8-1af4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632239777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632239777, "uuid": "a9160f4e-522a-4c84-83b5-b5d9a0384055", "comment": "Malware payload (RedLineStealer)", "value": "85d8cfa3d99b2061e2ff4e9197090133", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632239777, "uuid": "d33f3410-ac74-4ce0-ae29-f5eb90823e07", "comment": "Malware payload (RedLineStealer)", "value": "7872580d5105bd09cf386f9713b28854711d356fae34118bd855a9a694da4f1e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632239777, "uuid": "35d9ae90-1ed4-4ce1-b5eb-33361a2868dc", "comment": "Malware payload (RedLineStealer)", "value": "28054274f87f31b1c7f5f1413e958b78b0f552b3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632239777, "uuid": "687703a3-5578-416e-b05a-9bd04211e9e0", "comment": "Malware payload (RedLineStealer)", "value": "2da3e7f26549781fd790ae9ef8bad6b9c3dec2f507559153800b9711b04f28ab374959d429252cb92397dfeba4732d6f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632239777, "uuid": "68528945-fe6e-4bba-ae75-da399e64c632", "value": "T1AFD4120272D0C775C59752315B61E7A066B7F8304A39538F27A726AFEF142E13A3A32D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632239777, "uuid": "6e4d5015-7d01-4bcc-86e5-e3ec9c03ac10", "value": "98349bc8fa025f57a9d49df3092c15be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632239777, "uuid": "967b2e46-f003-4f3b-95e1-9099581d0ae3", "value": "12288:LmdqCg99jOQdZu+c5e6lWGRpkq1gspdMuLWWWp2/4fZHGNnSArFBaw:LmYjnjOgEeZqpk+gwM+WTAYZHGVbrF1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632239777, "uuid": "7006c923-142e-4a43-af86-b3321f28a121", "value": 612352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632239777, "uuid": "bbe209b3-3480-4943-97f6-dcf7c4796582", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632239777, "uuid": "9c582822-7fff-4bd5-998b-565dbc8ba812", "value": "85d8cfa3d99b2061e2ff4e9197090133", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf2c944c-1a7a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632187530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632187530, "uuid": "705abd7f-70de-4852-9240-5fbb61985f43", "comment": "Malware payload (RedLineStealer)", "value": "987c1348e107e270fce4f4fe7c2ef1d9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632187530, "uuid": "36bb9bdb-cd63-4ba3-a7ce-85ee63982c70", "comment": "Malware payload (RedLineStealer)", "value": "797a08991698e42bc81d763c93ed0aa911eb22e9dec9e00bbd2e12865f867c21", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632187530, "uuid": "e95eedd6-d54b-4c8e-b2e3-882cf9786c88", "comment": "Malware payload (RedLineStealer)", "value": "d2b0d155bbc31aed8e224391e8773c5b237959c4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632187530, "uuid": "3614da77-88ac-4cb8-8c99-ba64b232d538", "comment": "Malware payload (RedLineStealer)", "value": "fef222fc300649b87b5c9a7a9f58f1a2156cef0913bdd5c22119ed77dc9d41e1519085ef0d2a7ffd4306c3d40042c6d1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632187530, "uuid": "7f04f4cb-bec5-46e0-b33e-5f80a51ff5a9", "value": "T157E38477812554AAD6995E30E02D0FD736788D34684FF2A8B10AF26ADC2C54C9EFC367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632187530, "uuid": "7b7c1d7e-9a32-4d60-b3d5-153cc37f3fcd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632187530, "uuid": "b6859730-ec67-4ed2-9dd0-7e1b5acafd2c", "value": "1536:QzL6R3row8Ytti9IFiE7xrcWx3B1/BItj0DdmkyRJb5:QIQYttOOiE9rhjrI6dmkkl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632187530, "uuid": "bedd9f48-b81a-431f-b079-d747c63d0711", "value": 148992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632187530, "uuid": "fb149e1c-7eeb-4f46-8d0e-7c3cb83d7cb0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632187530, "uuid": "265b03c0-0105-47de-a148-9be67f236345", "value": "987c1348e107e270fce4f4fe7c2ef1d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b8e4f40-1ac9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632221374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632221374, "uuid": "3b857f52-ba1b-4a86-952c-3392a39880a7", "comment": "Malware payload (RaccoonStealer)", "value": "c7be1b666b8ec3b2a43bb1713fba6fdd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632221374, "uuid": "eba917c3-6662-4401-99bf-5f668c77f5da", "comment": "Malware payload (RaccoonStealer)", "value": "79b016ce5731ed6ba8a2f570c5d32b69f3ba9e6b6624e95e219df4a1626e67f8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632221374, "uuid": "a2e4faee-7bff-4d5b-94fd-aa80dc192da4", "comment": "Malware payload (RaccoonStealer)", "value": "c35c2014508f824348a7eef38cf05d0661f4237c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632221374, "uuid": "0336813b-0e64-48b4-a7d0-d9d138e187cf", "comment": "Malware payload (RaccoonStealer)", "value": "9e40da853dbebb6f6efd1547135b61a4a17de00db085f4957a44afcc320c965e4680ca2564b620d0553d3f51b5ff82f4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632221374, "uuid": "e47f3287-6473-4221-b84d-35237eed3b9f", "value": "T1E6C4AF7675628077F17200B0AE6CA7A1167DBCB009328E9B73C9063D4FB55D2D722A7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632221374, "uuid": "38e049e8-d130-4ab7-8a0e-dab5bf930883", "value": "35279f0bcb93fbb246a2ff5f9995bdc1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632221374, "uuid": "e5980366-cc7e-449c-a811-32a6656810e7", "value": "12288:jh/yDN787IPelHo8BM2rMayvaD7Jz52548cRWipfx8BjaM3bG7nU:d28y2rMDaD7j2581k3ijU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632221374, "uuid": "11c96b28-9a4c-4782-848f-340f6a15871e", "value": 579072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632221374, "uuid": "c1ae1b7c-e877-4b62-b452-9535fed9dae1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632221374, "uuid": "48db904e-5a65-4dd4-95a0-485fe8925f6a", "value": "c7be1b666b8ec3b2a43bb1713fba6fdd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7aaf0aa-1b25-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632261042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632261042, "uuid": "a25a6b6e-ced5-4c52-86bc-fd9da93250be", "comment": "Malware payload (RaccoonStealer)", "value": "09bc8817abc22b4067cc7720d844779c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632261042, "uuid": "5e1243a8-3531-44e0-a7c3-1f6888936942", "comment": "Malware payload (RaccoonStealer)", "value": "7b99761722d319d84a1ff7c9e0956482f95f704daba975cb4e57dd3163a35332", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632261042, "uuid": "d831de62-fbac-4403-858a-9d974391cfd7", "comment": "Malware payload (RaccoonStealer)", "value": "3ee725c675554d0f86a6fd26d820698cd875039d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632261042, "uuid": "b01662b2-14c5-488e-9e0e-9b7ec214ad19", "comment": "Malware payload (RaccoonStealer)", "value": "faf093d93d6982670cd94cd284160cf96e497f26fc197003453c04ac0bf0528daf2db2dfeac6818a602c47686df7e89c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632261042, "uuid": "54d5edf7-ec07-4e77-8091-89824fcf87b3", "value": "T16BB401017FA0C972CA9345304835D2A053A9F961F521CD6B7B66FB6E3EF03D1952A32B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632261042, "uuid": "562bc5d3-c5f8-4d02-bc29-da247af54a67", "value": "b423274974f58a1d1a63a5242c6dcf99", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632261042, "uuid": "39531923-1c5e-41ea-bedc-11611f11ec2d", "value": "12288:JHSES+NleTOXFUrVqGPB+g0nll32LuYLcBay:M4+O1cVqY+3eXcp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632261042, "uuid": "a986cbbe-2e16-4f5e-9cbf-8fd7ece9eb6f", "value": 499712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632261042, "uuid": "8a46c554-ac60-4f3a-a2f9-eb489d0a5bf0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632261042, "uuid": "7a91a92c-ee46-4b38-80a9-de3046815057", "value": "09bc8817abc22b4067cc7720d844779c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bafcb10b-1ade-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632230446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632230446, "uuid": "082e946e-a459-4fde-8e81-4e04eba25bd1", "comment": "Malware payload (RedLineStealer)", "value": "3a02a4034f00e225af45b20bffd2233e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632230446, "uuid": "92c7f45f-9ede-4402-8c22-a7cdc773c02a", "comment": "Malware payload (RedLineStealer)", "value": "7cad51a346a2c1441d4f87e9c4f848a61ba22506926fdeff1c0d315dfca515be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632230446, "uuid": "b8a65ac6-68c5-4700-8640-40e037c77307", "comment": "Malware payload (RedLineStealer)", "value": "0e6aaa0925d397d81322e8e3cbdd1f8998b143a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632230446, "uuid": "00eea8ba-1d15-4b9e-bf54-6b002c516926", "comment": "Malware payload (RedLineStealer)", "value": "90ff8a8ded2aa6a377fc08be1f25baf42dbf922e28218ed6ea11af0b5d1e395e5dcd175ed87b1ed7a0c6f8d8531f36cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632230446, "uuid": "d0da08ab-cce6-4cc3-bd3f-5a2e9c6225f8", "value": "T181F5F9502E8E91EFCA4605B69EC79903DB240BA744166943F6B43831FBA3F722DC355E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632230446, "uuid": "a98b4277-7ace-4f43-803e-32218f990eed", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632230446, "uuid": "01a07b69-669a-4e2d-ba6e-f697420fc54f", "value": "49152:FNJiDgMrLG+M1U51bQqT/HYeOBSw1tJJrjJeG:T6rLL8U51bBDytJJl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632230446, "uuid": "a6239f9f-3dc1-43c4-bd38-c72f0022ac2e", "value": 3448072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632230446, "uuid": "3564eb02-df3e-40e6-ac27-a4698ab57943", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632230446, "uuid": "ac6b838d-d590-4dc9-a386-0e3b0b257bd4", "value": "3a02a4034f00e225af45b20bffd2233e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a413321-1aa5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632205722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632205722, "uuid": "7bc36831-da10-4050-862a-8a7e3239cd09", "comment": "Malware payload (AgentTesla)", "value": "d8b0812d9fb1d312407405ad2870369a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632205722, "uuid": "e55a146e-51f4-4843-b4a6-dcfaa16d1ccc", "comment": "Malware payload (AgentTesla)", "value": "7caec07412d82a97d11585931d37bfbeec7dbe9ee6f14e96f11838884811e03a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632205722, "uuid": "ac63732b-a75c-4bd7-b22b-4f8c4fd81971", "comment": "Malware payload (AgentTesla)", "value": "04f505a431b7e3081a8958296e2b7047659628a9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632205722, "uuid": "84261407-264b-49a5-8e76-99dd4feb58ac", "comment": "Malware payload (AgentTesla)", "value": "8d3816fa3590a157a5aa62eee28e9d66d5fd1e96468b9d06ad003a543c22124025ef4425aa8a8d2ced60166d74b1da3b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632205722, "uuid": "6027d593-74dc-41be-9abc-e35a976512ab", "value": "T1E595BFAC3310F9CEC567EE3696643E649B50A1A70317F343A52714E9EA4E4DAEF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632205722, "uuid": "4d320d9a-00fc-458a-b3b4-70c8af866da2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632205722, "uuid": "8477c74c-80a1-4b11-b772-421823ac0502", "value": "24576:H8SLVSG6spLInTuYEWyzFfrQHi84VoniG8C7bdXlJZscpJAktkISo:LZV6cOHEZD6z4Vo0GbdXljPfS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632205722, "uuid": "ab63bc6d-4384-4c31-8159-34e3f2739679", "value": 1938432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632205722, "uuid": "2a5aa93e-7b66-4a2e-ad6b-97519bac79f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632205722, "uuid": "c9044c58-3d44-4385-aa99-16baec986266", "value": "DHL Receipt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b2ad0d1-1ae4-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632232808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632232808, "uuid": "85adda60-3fd3-4dbf-a3c1-1805006030ef", "comment": "Malware payload", "value": "6d6fa9423e17149ccaf4e4774db20547", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632232808, "uuid": "7066fed6-f306-4ade-87a5-da77310560d5", "comment": "Malware payload", "value": "7ed8d364ded70e548de52b2ab46f9c45f84238051c8ae6f209b5b29d2d8a08ff", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632232808, "uuid": "b6a5d87a-1be7-49b8-b97c-0e9d15edc5fe", "comment": "Malware payload", "value": "d22bc60b6a100d2f62ea65b5d8d3c26500c713b5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632232808, "uuid": "a1060764-d34e-4871-9411-6c61f8b7ac27", "comment": "Malware payload", "value": "1f18c4f77045f04d609c3a295a8cd3172ab5fc21f932b6bebe8be077b5db7106c352e31553263eef570aa45729868a83", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632232808, "uuid": "4aaeb553-b73a-4889-bea9-464c84a02007", "value": "T18123F190CD4B2AB28EB58AF13B744D1E7E6BCEB5535843A221480584BBC3B475147CEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632232808, "uuid": "6abda398-2745-469b-a2c8-a3830e80dac4", "value": "768:HMs7Ebyjc9LHBdVyQB74OkzeD7IZOH0nZtJoH0HhHlGoT4MM883U8jvbTB95aWNq:sIEwc9D4cAOUrQyHlV0MM8WtmYq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632232808, "uuid": "ef59ce60-9e5b-4002-a12d-cf9289ebaa2d", "value": 49892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632232808, "uuid": "267ba1a7-4bfd-478a-a6c5-54f673c2ea64", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632232808, "uuid": "e0fa54d4-97f3-475f-a7bb-93cba4b3e86e", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41ef24db-1ab7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1632213492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213492, "uuid": "23c73b4b-0277-4ef7-9845-5c527209a59e", "comment": "Malware payload (njrat)", "value": "d660755f3b41cdb325a1319cbd3497a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213492, "uuid": "51279215-2801-4a02-9a50-60d8858f29a3", "comment": "Malware payload (njrat)", "value": "7fb40d2c4011f9aa66d25183702ac6872fff070ff9c7433fab6d3785ebc95f4c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213492, "uuid": "714b028a-aece-4f51-ad4b-8e762aef7f68", "comment": "Malware payload (njrat)", "value": "edea8ea5b6e77624a98ae7f9afc6ba7c05015fd5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213492, "uuid": "7ee15be5-f5f0-4d04-a556-a919caf52717", "comment": "Malware payload (njrat)", "value": "eb56f69fd7e0d7eed24e4ac98624304f2dcd61f3e5398bd2dd3f33cdcc42509e0a34346ea207e46e8630e3312a86d0a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213492, "uuid": "0ae952a1-23da-43ec-86d2-d375a47b1dc3", "value": "T123451302F9C585B2D631193118659BA1617CBE201F259FEBE3E42E6E9D300D1BB35BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213492, "uuid": "6b731eeb-d97b-4ff3-84b8-6b2a993fe90e", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213492, "uuid": "364b64e0-be7a-470b-9f6f-3ea7ae6dc181", "value": "24576:6DWHSb4NhC8ZlwBw776A6w2d469Gzw9KAUtfprbp//JGMcaq:J84vlwBQ76AN2d46Ew9Etfprbp//Jlcb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632213492, "uuid": "399ad0e2-2e37-41b1-bcc0-d9efeb7483e4", "value": 1278560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632213492, "uuid": "db1cde63-9d4f-4fa2-aa27-ab740972cc11", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213492, "uuid": "55c6bcde-58da-4b9b-966c-6e745fb37d65", "value": "7fb40d2c4011f9aa66d25183702ac6872fff070ff9c7433fab6d3785ebc95f4c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e548c5da-1ada-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632228799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632228799, "uuid": "0eae3215-8ec6-4bc6-9b55-2c9bd223b2af", "comment": "Malware payload (AgentTesla)", "value": "8d2c39a1c65d1d9d1c43b341c18cd555", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632228799, "uuid": "18189cb1-3be1-480d-a669-731d9f76e1fd", "comment": "Malware payload (AgentTesla)", "value": "7fd0d5d4d28ae153760ff1db3f21d11957a7967f6d6539d2781bab47a4a5f1d5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632228799, "uuid": "2fc5b14e-7a0a-4063-915a-cd2ffcc3b454", "comment": "Malware payload (AgentTesla)", "value": "f90076599865645ff9434998d71d37569371cc80", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632228799, "uuid": "7a5be5db-e298-47db-9cc4-11bbf51d7709", "comment": "Malware payload (AgentTesla)", "value": "b8dfa598d830070d74f8d718b44923262d852561688741d4154caea1323e3a9bb88fe00a9a80ffe56295c9a54409539a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632228799, "uuid": "08cc531d-bd63-4ead-8b9b-0127280587aa", "value": "T16E340DE4688F44B2E6498C5DA494B148AD74FEE334CA887153AFD435DF59BF2AEC4083", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632228799, "uuid": "bae27151-d883-46da-8889-2299206244c9", "value": "1536:izFHYWB6IWEp6aSJIOA0RoBNJTloJRR0ss2wdzFz76mAg5eeVhMDw5wfL7:izOWgv6ss/dzFtr5RDAw5wf3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632228799, "uuid": "4e552c5f-1bcf-4a93-bd37-c4cd411c553c", "value": 247316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632228799, "uuid": "595f7847-bdb6-4b02-bda8-596fe8e1dd14", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632228799, "uuid": "aeb3d76f-5bcd-4a9b-848f-effcdfd27001", "value": "OOLU20326507511.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ba70982-1a74-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1632184625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632184625, "uuid": "983649e6-f82c-42e1-9bd0-3828256c3ed2", "comment": "Malware payload (AveMariaRAT)", "value": "c62f43e12c6b29afa0c200dd06ea2722", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632184625, "uuid": "bb910199-c304-4d95-9edb-21124f82f656", "comment": "Malware payload (AveMariaRAT)", "value": "80979589782802235793c8b3916c547e06d9b2d30c685ef788335c37ff3b3e16", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632184625, "uuid": "81f1db8b-6b9d-46f4-a2ed-00332cb192d9", "comment": "Malware payload (AveMariaRAT)", "value": "97909e6f127a3a94003018e3c6e2d431a8dfbadc", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632184625, "uuid": "6c6a9f6a-6fdc-4740-afde-44c1854ea875", "comment": "Malware payload (AveMariaRAT)", "value": "0cd9e7bc31c296d17540ee65cb4d381d7959b41bc1b697ba9414665446f7cca20aeb3ca3c76a3d77082475a922a2469f", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632184625, "uuid": "dce4fa9d-9131-4635-8385-8a539c030370", "value": "T133557CAC3310FACEC567DE3585643E649B6074A70307F343A52B64E9E98E49AEF440F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632184625, "uuid": "52b11adc-5ce3-49e6-8c8a-71f54c097959", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632184625, "uuid": "680ade03-b1d8-4361-a2ad-e8dc55615438", "value": "12288:2DcyVtfbE0Nuf+nvWiql+58iok2gKRu4/e5FHlIdUW94ysdWjPXjXb2C0NEAllvd:2nVtfbzNnvel9Ru4/e5FFO3Ar", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632184625, "uuid": "836ccf5f-c79a-4786-a5af-7b4cc9f25baa", "value": 1344000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632184625, "uuid": "dea4281c-d1b8-4388-9b2e-f1078396fb2f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632184625, "uuid": "c30dbd3e-480b-443f-b904-8269eb6c5102", "value": "DOC51098.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb61e3ce-1aec-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632236459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632236459, "uuid": "f76b5d1c-983c-4ef8-a468-ed4da9940654", "comment": "Malware payload (RedLineStealer)", "value": "2e83f3341b7e7468f8a6bed8ab8a3f71", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632236459, "uuid": "5f165e7a-1b5e-4556-a5c2-44e395c824e8", "comment": "Malware payload (RedLineStealer)", "value": "811b982a5a257a2a9acd46bbf0f68a166470726017e60bb752410ece2cf01ef5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632236459, "uuid": "47bb591d-1fc8-4315-8640-aa09dfb616c3", "comment": "Malware payload (RedLineStealer)", "value": "1c024b48d9b83167076bc2bafb1b69e84a7920e0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632236459, "uuid": "d0ca526e-3add-44f4-9a1b-e94fa18321f4", "comment": "Malware payload (RedLineStealer)", "value": "131c52c68a175d439b93e05f377fcbdbd376c6884c79526a5bc8b589c1f4074e502c215ba4c5cbda496ae8e6b26876b4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632236459, "uuid": "07072ab7-41e3-4699-9e0d-b253af3136ab", "value": "T1E5D412017290CB71D5A705311711E7B16AABF8B099B5838B6B43369EEF343A07F72366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632236459, "uuid": "a1d8076d-7821-444b-ab2d-baf481cd3bbe", "value": "b4a5f131bf57e0871ab3cda52113b279", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632236459, "uuid": "46ea00c0-1e4c-489c-9a9b-cdfb9832e188", "value": "12288:H9Yb05W/SS7PQzyWs6iSpN9FZlb+e0akjPekwtYA5SA3W3Baw:H9g05WbgyWVi0fF7ie0rjJG/b381", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632236459, "uuid": "658819d6-0817-4a9f-a232-613da8c7810a", "value": 612352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632236459, "uuid": "c7094a2d-a7b5-4d69-9bf9-2fbdf41adf12", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632236459, "uuid": "a54e1dd9-6eec-451b-8147-683b82b09a05", "value": "2e83f3341b7e7468f8a6bed8ab8a3f71", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4895253-1afd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632243776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632243776, "uuid": "1e78cc9d-b79d-42e8-b2ec-887dc2efb8a0", "comment": "Malware payload (Formbook)", "value": "06ea8725b99f6d3f39607fc8df58b325", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632243776, "uuid": "8a51522c-47e3-4001-9606-f203e220733e", "comment": "Malware payload (Formbook)", "value": "816b319b12795c8135c2ce7d89c469580e3b8874f1033d077ecc91442a453ebc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632243776, "uuid": "161c2e94-47ff-4e9b-835b-1a1e431f3180", "comment": "Malware payload (Formbook)", "value": "f154a8db01eaa2f3df6841dd0bb6868ae4e1cb41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632243776, "uuid": "0429caef-3474-471b-b704-f068ac261b46", "comment": "Malware payload (Formbook)", "value": "831318a418d9ed9b87eb13bdd442649aecf6ec1be5249ef4d237c562334bfc17d5786d7628fdd69d017c90902d280a0b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632243776, "uuid": "f2617bf2-6c87-4f51-bb16-8bacb0e33a46", "value": "T1D1C42334C375A376CD6ADA7F2021A01A0F7172D67B13E36D9F95B08B7D0A7964022CB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632243776, "uuid": "2caf684f-bb29-489b-966f-951b93e8ef90", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632243776, "uuid": "4c0931fc-5876-4a49-ae37-72c9d10b14a7", "value": "12288:4NY1mtiK5oBGzeTmmHENX/a5OtM6stp7D72Xpb:n+FoB1mxVtDQp76", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632243776, "uuid": "a0e9bbde-8ff5-4863-a1ef-c01b00fb418b", "value": 588288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632243776, "uuid": "66af994e-6d36-492c-b3c3-49514c8bb4d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632243776, "uuid": "4f4b9c5c-9b3f-4eef-9a6d-218260d029fb", "value": "SecuriteInfo.com.Variant.Bulz.729418.32362.3087", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d847465-1ab6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632213163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213163, "uuid": "a4151d20-91a8-4df1-8851-bbdefc8419be", "comment": "Malware payload (Dridex)", "value": "6a8f86e9eec7c25518d1bea339ca9124", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213163, "uuid": "0bb88107-51c3-459b-bb38-56d89ca70fdb", "comment": "Malware payload (Dridex)", "value": "81eb5c7c2ed2248aa48c53476d5aef8efca3d6f1ae43b56a0621ae9c0c349fc8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213163, "uuid": "51fac202-d063-4090-9070-49d69da0f2bd", "comment": "Malware payload (Dridex)", "value": "dfeab63f0a9be393ce2cfd3ac2a28c6583b5f16e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213163, "uuid": "bd3ceda1-277b-4349-aa79-ff9be1d5cd10", "comment": "Malware payload (Dridex)", "value": "34d8df5c820c4b6a7f108f86057c54838f108873918582557edca7942d36e93ac25e493036c95beee50213f58a995887", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213163, "uuid": "f3123519-7c94-48a2-a9ce-bdc99aa65fa8", "value": "T1D685D020EE69E1E6C6B89F3E9408352727F93D75110D608CC392704F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213163, "uuid": "3f22b374-2804-42d4-aea3-1dd9da37fd8e", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213163, "uuid": "e525d55e-e2bc-4ed1-a13e-e736091f18f9", "value": "12288:XVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:efP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632213163, "uuid": "0e493344-1316-46e7-9f12-b511aa64b3ee", "value": 1740800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632213163, "uuid": "18851e6a-65fc-4878-8be1-e32f673d72fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213163, "uuid": "408889bd-2ee5-4697-9dea-3e6d2f6f65d3", "value": "81eb5c7c2ed2248aa48c53476d5aef8efca3d6f1ae43b56a0621ae9c0c349fc8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ead2a52-1ab7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1632213406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213406, "uuid": "3e7fd283-3f31-4aa3-9886-43fe4774b9a9", "comment": "Malware payload (njrat)", "value": "a1c0d1485d1f2ac0d660ea28502e79ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213406, "uuid": "2b7f2d98-5527-430b-a2d3-0072c952753e", "comment": "Malware payload (njrat)", "value": "820f2381fe1860a8b6f9e66032ac4bb79ac6b7b9269264c547e4c63151593df0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213406, "uuid": "55c14dfe-b0d0-4344-b72d-a2b406406808", "comment": "Malware payload (njrat)", "value": "fcd8a01e7c022c086747a680bb8995f9279aaa8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213406, "uuid": "5c1c4825-f50d-4cc4-b33a-3d89224c82f4", "comment": "Malware payload (njrat)", "value": "c0c57b7b3f2d323c708880e20b70f3dbb34b7c709bf83761a1f569d3ebca62d1e6da02c060fb6aff2a1340a261db48dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213406, "uuid": "a6b3f1cf-395f-4e42-8284-cc74cafb9fd9", "value": "T169F49F31F2C08837D9321A7C9C5B92E5942ABE212E35B54B3AE52F4C5F396C239163D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213406, "uuid": "0bad3c56-cb3e-4fd7-ad49-3502ae53913a", "value": "e5b4359a3773764a372173074ae9b6bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213406, "uuid": "a3f1c913-eabd-4f53-8e2d-47041cdf7caf", "value": "12288:k9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hwpNNg7J:oZ1xuVVjfFoynPaVBUR8f+kN10EBySF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632213406, "uuid": "342c1848-3b27-46f7-abda-3f47694cc9f6", "value": 750080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632213406, "uuid": "9acd3e8c-fd5e-41e0-bfc2-0d8a81cbde9a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213406, "uuid": "8e102ca0-2f21-4a10-9724-20b0b7960b2a", "value": "820f2381fe1860a8b6f9e66032ac4bb79ac6b7b9269264c547e4c63151593df0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28ee73c7-1aca-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632221611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632221611, "uuid": "7c469088-7aa4-4141-bebf-c42831b026ce", "comment": "Malware payload (AgentTesla)", "value": "e736a562e64b37759b70179a78bc80ac", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632221611, "uuid": "cf6f8b39-30a6-441c-bfbd-3577dfe1678b", "comment": "Malware payload (AgentTesla)", "value": "8251754067fc5ad3181ae87b61ae316a9618ab2d578111e2a58e38a3dd4a1c8c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632221611, "uuid": "001310e1-deff-4cad-9adc-1890707e13ec", "comment": "Malware payload (AgentTesla)", "value": "c68a5aec427830f0ff11e7d4f95aa759380540d9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632221611, "uuid": "ee988945-9196-415d-82ec-ce7b711a5ec5", "comment": "Malware payload (AgentTesla)", "value": "6688dcd255266a958ffd21ea182bb7989d1b4aee4f8f3514d55f0611333e5377d22908c5443cc3b4b199323e2c5b723f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632221611, "uuid": "13c8c7cf-eaf2-494d-8f80-8a6f406c3294", "value": "T1B7D4125272BD4648DB9A3BB5206087507F73BE750873D94E2A8D318E0F3B6429E71B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632221611, "uuid": "76a50f66-4c46-4e63-845f-3f67f35bf767", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632221611, "uuid": "8f1e227b-6a84-46aa-98f8-329279d3e729", "value": "12288:cOIbw8eGGmtiK5oLOFd1ORRS7F8BS/5Z9MfBUHSCeYTQMJRk:mbw8eGG+Fo7RAZ9MfBUHShY8c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632221611, "uuid": "32ff7e6c-3952-48e9-bd95-25f49b3d1937", "value": 639488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632221611, "uuid": "feb6943e-9669-488b-984b-f29ebce31899", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632221611, "uuid": "d6783373-0fd6-42f6-bec8-b0292115aa97", "value": "FACTURA..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baa56667-1b0f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632251491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632251491, "uuid": "50092dcf-eaaa-4e17-b302-be1f95c7b785", "comment": "Malware payload (SnakeKeylogger)", "value": "4ff894b79463d1b2ec17f56825dfce95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632251491, "uuid": "1399e4d7-39ff-4d22-b9d1-6bbe235d4268", "comment": "Malware payload (SnakeKeylogger)", "value": "82fec44e43fc056ae43c3e9635f1ba3893b9b88f2a253fa08e7bd21f53b10303", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632251491, "uuid": "1b1db51a-dd9c-4621-bdd7-7b186f2e726c", "comment": "Malware payload (SnakeKeylogger)", "value": "999db0846941aaa8a814c592b89fd1e3b37a27bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632251491, "uuid": "a4f52060-b6cf-4d27-a95d-df1ec0990fc1", "comment": "Malware payload (SnakeKeylogger)", "value": "b0bae3a7af4dbc63f2ad192325dd172e5250ad64230188bacf2a2e5af76dfe5360ff1a41da410d4e30da266c83f8792d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632251491, "uuid": "eced45dd-e952-4494-86c9-f0a19d615f7d", "value": "T15505E0F25A026D5AFB650938BC05C5F00F565D4FC26045C8BFD92EBBB3EB6E08978960", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632251491, "uuid": "cfd259ec-26e3-49ef-9ddd-783670e1457e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632251491, "uuid": "3243e75e-647d-42eb-8abb-dab2e4dc8ea1", "value": "12288:/F6QTTQxJfEhREMvXOz/2l5VEnMs20hV8isHc/7VeGsEXWJCjXR9iEh:N6QQJ8vq/CsxhV8ilUGBXWJ8X3iEh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632251491, "uuid": "a7740639-fdec-4b19-9526-a14de89dd338", "value": 872448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632251491, "uuid": "e0e2b689-ba78-4a36-9b1f-739707642d85", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632251491, "uuid": "d49fcdda-152b-40b3-be49-29a23b86b187", "value": "PO092121_xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "790c6dfe-1ae5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632233342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632233342, "uuid": "93ae28d9-d838-4aec-b8d8-d4eb010df87a", "comment": "Malware payload (SnakeKeylogger)", "value": "ff2f1b098c90c0bc6dbfabc82f0782c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632233342, "uuid": "b8220597-c586-4bfb-8aa2-1d246f601cd9", "comment": "Malware payload (SnakeKeylogger)", "value": "834833adf2996b1c2846f36b48aea5ec0b71fd7f14e314baacd3755d27825197", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632233342, "uuid": "f1bfbd67-0f27-4e27-8f96-034412ea0a6e", "comment": "Malware payload (SnakeKeylogger)", "value": "86d36bc622b77a6d9d4b765f130656e95c42c056", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632233342, "uuid": "4ee554cc-3535-4358-8241-c1ee62c8b764", "comment": "Malware payload (SnakeKeylogger)", "value": "16e8d45322f8e2d2330e1fd612223fe90e5c4f97e563c4ba61013033434a2ed74f0ee2e9c605997530641304661b6b55", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632233342, "uuid": "d6109282-abd5-4085-830b-e4b712368eab", "value": "T1A1B42374E4C684E6EA585E710A3DFC68F3B87308847F490783A0FD6D3836696D726CA5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632233342, "uuid": "c5585481-e43c-4306-8bf5-315e39cfa779", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632233342, "uuid": "050d52a2-11e7-4fe0-90d0-eea1fb6b5480", "value": "12288:nKI+TKq6Ny61IWqzGsci2Ijoqz7/pcF5R:nK9TKcD4rmCR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632233342, "uuid": "9d125c06-975a-4cea-81af-af757f67f70a", "value": 533754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632233342, "uuid": "8f4dcf13-ae0e-4022-80bb-495c8f8fa9b6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632233342, "uuid": "ad2ada4b-3dd4-46ea-9966-7f9a88c9e986", "value": "8765256789987654t84.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06020428-1ae3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632232290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632232290, "uuid": "53f2f600-d325-479e-a64d-bd36bcc7c331", "comment": "Malware payload (AgentTesla)", "value": "a3d3cc3a7c7426ce556c085c12a96533", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632232290, "uuid": "9c2b70b5-285e-40f8-b449-d89ae1a687d1", "comment": "Malware payload (AgentTesla)", "value": "838637a3911f4d8b6af752a1507c4b15610f11bdc2fc6e8074b8295653048b50", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632232290, "uuid": "60a9a8bd-be3a-49f9-9f3f-41eb8cd6d043", "comment": "Malware payload (AgentTesla)", "value": "f0183a21c4776aa1a7a0b813fc725dc363dedcf9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632232290, "uuid": "3215ece2-6e77-4a85-bbb8-5c3c9bb21ba5", "comment": "Malware payload (AgentTesla)", "value": "3db95d029f59f061edd7c02e75bd9f51bd22cd24e9f0991f6512a14a0127920b1f1314075ee70f5221da0ed9ef974035", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632232290, "uuid": "7f9f95b3-3eea-4312-addd-deaa1d62825a", "value": "T151C1E806A3D88327ECB70B782C7363415178BB11D873DF6D3AD8411EAE567459922B61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632232290, "uuid": "d558be79-a18f-4c04-9d8d-9e07c5a661e1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632232290, "uuid": "4fce619d-11f6-466d-bd42-ee878e5b144a", "value": "96:a8N+z5XkzjP6jZ1+w2b688mgE9F167VyzNt:nyZwug9F16J0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632232290, "uuid": "21988074-e997-45f4-9952-6f62396f9be2", "value": 6144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632232290, "uuid": "4f287f92-86ec-4783-92a3-56ce0acaa21c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632232290, "uuid": "99257dce-bd85-4cd5-9999-20106c2534af", "value": "detalles de devoluci\u00f3n.PDF.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "539c3b0d-1b1b-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632256472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632256472, "uuid": "9846e9d4-0459-4aff-bc11-35b6fc45923c", "comment": "Malware payload", "value": "3bd6f12e4d6f4ed06a414a6cb100f546", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632256472, "uuid": "48b1e0b4-da69-43ab-9ac2-38529f9e7780", "comment": "Malware payload", "value": "84236953e6059c7733ecd777604a225ee85dc96740a46aac1379d13b3d57630d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632256472, "uuid": "fc20f579-3c09-4ff1-967c-d55ca3200c19", "comment": "Malware payload", "value": "d939170a645bbfadf65a5fd6f06bda4ac3be0900", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632256472, "uuid": "095227fb-db8c-4628-adcd-186cece89cda", "comment": "Malware payload", "value": "dc67d732f6a4c02d859ea093aa886f736aabf80c84d6810ad73b9d06f15a498a82ad13bd932838a872b054cac4ba4e6c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632256472, "uuid": "fbf90517-f776-40b7-b166-49d84eaa8881", "value": "T144C24300B7A4CD23F7E10A315E2792891639EE0BDC52AA5FAB5B3F0F7D7110D459AA50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632256472, "uuid": "89f8cebf-0dff-48e8-944d-67f0d4f9b20b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632256472, "uuid": "cc0d862f-fc83-4693-adb9-e4f3a2502fd2", "value": "192:/r/maXg9VVIIffLaVd1fgkuacPHAzmnzmJrR0HA/uvJRBBX5iVECAoVU:/r/maQfVZffGzSkCPHeMKJd0gmX0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632256472, "uuid": "10ee329d-b3e7-44ff-9b36-240c60ac9344", "value": 27648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632256472, "uuid": "a2d6122b-69af-4103-909e-026951b060dd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632256472, "uuid": "6b8c917e-ec90-472d-936f-9f936b0f2d9a", "value": "3bd6f12e4d6f4ed06a414a6cb100f546", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b56903a-1b1b-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632256458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632256458, "uuid": "6c1f7491-e75f-4cd6-92f0-45a235909a1b", "comment": "Malware payload", "value": "60b5efcc9ea0f944ac7fab44ace01de9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632256458, "uuid": "3d705e10-3c1a-43cf-9e11-23312d03b174", "comment": "Malware payload", "value": "84b28e876636b333e63e90bf2aa72ca80ff891c8bdebcb85200fba34d865bb91", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632256458, "uuid": "142d3325-2798-4620-854a-3ea5f36e2de4", "comment": "Malware payload", "value": "e127126f99818d24118b1b51f6a773b9a2a1cb32", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632256458, "uuid": "0545cc0d-192e-440c-80cf-db554da55834", "comment": "Malware payload", "value": "4cb4153d11eb083204ac28c077c612d132bab7cccc9395c434e7a30c6a793fa5d290fde3dd9a32d80dca7944ad1f628c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632256458, "uuid": "908a5163-147b-4760-a61e-cbf282a61a22", "value": "T12213E545B264DE26D2C50AB28EBFE54816B1DE428D02CD0A379B3F5F3D3371D4A8E909", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632256458, "uuid": "193a86e1-7d4b-4b97-8529-786bc7e68e71", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632256458, "uuid": "fe4e9411-3b37-4939-b3f4-a6e09d316a7b", "value": "384:lLdbWx8Ebm0UQ1aeIjngpIL6lV+Rb9sf/H2lh9seh7NS2ffZ:7bWx5tDw5jg2LPbGWj1h7si", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632256458, "uuid": "7246080d-a4f8-455d-b62a-3a2af5c4cdda", "value": 41984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632256458, "uuid": "44faaf0a-e5cd-48a4-af82-d5ac06d10f47", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632256458, "uuid": "3071b4c8-a92d-42dc-80b6-5b514415b072", "value": "60b5efcc9ea0f944ac7fab44ace01de9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "996d9644-1a7b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632187869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632187869, "uuid": "d3fa0851-c149-4635-b620-edb962a21ebc", "comment": "Malware payload (RedLineStealer)", "value": "a7c1b119a4fec4447ead224e8d404026", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632187869, "uuid": "458db18b-619f-4939-ae7a-91357cd0325f", "comment": "Malware payload (RedLineStealer)", "value": "84d3bcc681e62b477fd9e0a4f18c351c1ccbaa3753bc6ee32e56c54bf6753404", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632187869, "uuid": "b5ed3a7b-67bb-4c2f-adbf-9b13aed71a7e", "comment": "Malware payload (RedLineStealer)", "value": "7de3a01c615762ae351541e3254a1e426b325933", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632187869, "uuid": "e56dbe26-039b-4649-862f-998a0f5090da", "comment": "Malware payload (RedLineStealer)", "value": "d65ef7e667ea4a5cc7def9acf5d0d61079431110d583282e23eaf0910da7d84b9a146c8d034eb2a708cd28f30e0b80b4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632187869, "uuid": "f5a491e8-ac29-4488-a8bf-634ab25c96c1", "value": "T114E3836750117266C60C0730E05D0B7BF658F734B980B6DCB05AF2EE9929ACE5AF867C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632187869, "uuid": "52c559ed-8a10-45eb-9e2b-6ad36949d479", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632187869, "uuid": "3b0584ed-11bc-4bb9-8612-319d2b89b983", "value": "1536:L4PoITXsyn9pUQNP9gfzgqt5unTR5GP9ZlJmHba:L4PxXsy9aQqR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632187869, "uuid": "9a7f19c0-099a-46f2-9745-391bd3281e5c", "value": 148992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632187869, "uuid": "6f0e136f-7ae5-440c-ac00-3913000af7d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632187869, "uuid": "b4068dab-e8da-4e75-93c4-0d597b0a495f", "value": "a7c1b119a4fec4447ead224e8d404026", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66b28c51-1ad2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632225151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632225151, "uuid": "d08b60d1-a0bd-41e8-844a-0d2e2e437ee9", "comment": "Malware payload (AgentTesla)", "value": "46e9ac49c4bc6a8d57a2a05e66560716", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632225151, "uuid": "d1363218-68b8-489f-b80a-bd1ad4ca601d", "comment": "Malware payload (AgentTesla)", "value": "8572c44eb631a6a40df8e0d235c3427a74ca77560f0a0a00923545bd36477915", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632225151, "uuid": "fecea209-4e3c-49f0-8c47-1d7315096891", "comment": "Malware payload (AgentTesla)", "value": "5c7f1df0fc6f3d14297ce4a4be7a96f3920f01af", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632225151, "uuid": "c650d225-d0d4-483d-944d-7148eecd3da3", "comment": "Malware payload (AgentTesla)", "value": "9c1df362af3ddbff4284f576883b4c5172f9ccf70f0930bb24c10293c12cd4ab0f3c430abe097a67c6c8ee15320f6f3c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632225151, "uuid": "608d3c46-7c23-4073-a954-61182adbc6ea", "value": "T1EBC1975963F98336E5B78F35ACB382511278B623CF66DB5C24E4152E9C213149E23BB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632225151, "uuid": "b99f186b-27b2-4187-bb06-3fc55227d2b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632225151, "uuid": "277805a4-4efe-41ef-8f09-ab3ba2da6e58", "value": "48:6y94Pbz4eyuJaXVw2bzQ0n/n6wn+3K3zwthq8PA9iMlarVl2FnSfbNtm:labzKw2b0A/nPGqAp/zNt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632225151, "uuid": "6a09fb20-a6ba-436b-b34c-0a0bd754b513", "value": 6144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632225151, "uuid": "e519204c-adb4-4e7c-b438-c0379f521daf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632225151, "uuid": "f75ac099-095b-427c-ad62-e504a39b4f7b", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a670ffa2-1ac0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632217527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632217527, "uuid": "fe8d88bb-a986-4649-adf5-a3c6bf150e98", "comment": "Malware payload (AgentTesla)", "value": "9a5d63bf4ca71f796564d93d42c38096", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632217527, "uuid": "ff3b804b-39fb-455c-a845-b8138479aaa4", "comment": "Malware payload (AgentTesla)", "value": "860c1e85611a3e196f4650e8592238dad356202fd1d9a54af8ee4514cbbc0fbf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632217527, "uuid": "c5b7a407-adba-44cb-98d7-6cca705459be", "comment": "Malware payload (AgentTesla)", "value": "23f06f65025bf18d53365e712958ff4a2f6f3d28", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632217527, "uuid": "4f0ba55d-ef39-4283-82a3-0f3ded54e3b5", "comment": "Malware payload (AgentTesla)", "value": "8c4f97420b22863a012941f5c5ac4e92913066d0b856b1a1b3cc8cba20c17241c54f98653a7bf0924592cdc2cedaf4c3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632217527, "uuid": "c6384e7b-c663-430b-bc91-3662f2acd06f", "value": "T1F9942886EA804584DC3D6B70243E8D25961FBEFAA8B8B54D2F8D763577F31E3143244A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632217527, "uuid": "f2c30eff-6e59-4b31-a518-58eb60c7754d", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632217527, "uuid": "41704a17-a5f9-4c06-ab16-f1d9c0eb3341", "value": "6144:w8LxB60+uhQMRwSq1SKSFKn6l51NThRoZ+DYhg+Fitf2eCZ3wy02Kmz:9+uhQMRWTSgnaPXoZ+DYgtOeCq2H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632217527, "uuid": "3515b101-f968-447c-acf0-b487e2eab1cc", "value": 412930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632217527, "uuid": "95f77a6d-31ad-4b63-bb92-dbbd9fc48b40", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632217527, "uuid": "cb2a3421-3fe9-49a1-8dc0-daf8ba817eef", "value": "04142021_10RD0207S0N0000,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fb48d2b-1ab6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632213032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213032, "uuid": "5cfaa82f-c731-48c4-bc94-64c1071e8cf6", "comment": "Malware payload (Dridex)", "value": "9255252ebd76b9cb20f694c679da82e0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213032, "uuid": "c1d449b3-8d19-45fb-9dc5-8ac3027d853f", "comment": "Malware payload (Dridex)", "value": "865781ae8d7cc4a51821328f644b6a474f29dbf7b755fd1e242614c86eccee62", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213032, "uuid": "9eaf4c5d-57ff-4a0c-8c88-9bd8d36ac6e7", "comment": "Malware payload (Dridex)", "value": "5fa8203582ffc9183c404279e55055d38f652775", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213032, "uuid": "81682886-e519-4d30-88c8-0e838d0efbe9", "comment": "Malware payload (Dridex)", "value": "f8b0a2a29518f34bd7a2e0c78e1cd9108ac8fbe7d79d23674cf2b0b944c5a0c47d40c55d50cf7f6d54b716a0d7277560", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213032, "uuid": "dfb01a66-c47a-4035-8880-69c7bd220976", "value": "T121A5D020EF69E1E6C6B89F3E9408352727F93D75110D608CC392604F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213032, "uuid": "d7b29d8a-ac43-4cfc-bc28-3d88b11a3286", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213032, "uuid": "ee134caa-f076-4d99-858f-4932a976fae5", "value": "12288:mVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:7fP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632213032, "uuid": "61c74e62-ddb1-4b1c-b9b3-b16691dee918", "value": 2203648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632213032, "uuid": "c1c8dc67-3b69-4e3c-8c3f-905a2313fd65", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213032, "uuid": "7d88fc1e-788a-4bae-9fee-50e66e9f43a4", "value": "865781ae8d7cc4a51821328f644b6a474f29dbf7b755fd1e242614c86eccee62", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eef17db-1a8a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632194241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632194241, "uuid": "03b3a215-c454-4dba-9d0d-a8e8681a1fa4", "comment": "Malware payload (AgentTesla)", "value": "694463eb61e537d2612509a8ea6ae609", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632194241, "uuid": "a0101dd1-92d9-4897-a989-ec1cdba39194", "comment": "Malware payload (AgentTesla)", "value": "867fcc3ccde72093cce50dc301671b28a5789197678d56669c5c892edbb9c973", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632194241, "uuid": "91095a01-a299-4a13-8ab4-27ee4d4dfab5", "comment": "Malware payload (AgentTesla)", "value": "43e8d4ccee29c802b118e3d146bc63d9a6f151fd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632194241, "uuid": "08066345-bd03-497b-8147-b0688901d09b", "comment": "Malware payload (AgentTesla)", "value": "0ce738bae819f4b4b583c861f49bd642f447447b063285a597fc2e325930a335c73d765798a01f19a36e48fc9a27bf28", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632194241, "uuid": "c2573bdd-e9e4-4364-9704-8eada95229a1", "value": "T147055A394D2682F787EEC66CD08C1FCEDAA6A4837B919F1AD496D7C2025770FE48845C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632194241, "uuid": "f8267b58-b4f6-4aa2-9b92-d83e23519c88", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632194241, "uuid": "ebf9adfe-a3e4-4a12-9f14-8ac4a211d0e4", "value": "12288:X2O0wvRBSwFLvFTPi5jhjC9N0tLGOQgP:RVn6Bh4iiOQgP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632194241, "uuid": "0d9364eb-f4d1-428c-b95c-24db1f7f42dd", "value": 856064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632194241, "uuid": "2f7b8af4-b7e6-484a-8a99-da619f4ed986", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632194241, "uuid": "6a4465f6-1bba-4d81-b84b-e5094135ea57", "value": "no. 4023- (BC draft for PO67282).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f62ec4ae-1ab6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DarkComet)", "timestamp": 1632213365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213365, "uuid": "bb3a94d5-db14-45eb-a57f-dc6f543246dc", "comment": "Malware payload (DarkComet)", "value": "33e875da891b7163d2a47174805b85f9", "object_relation": "md5", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213365, "uuid": "f51ea908-f97e-47da-8569-19a36f8feaa7", "comment": "Malware payload (DarkComet)", "value": "86b764d2e91feeeb906ce1da88d84995e7d474d85a7d8f8932105618be8617ef", "object_relation": "sha256", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213365, "uuid": "ec93406d-f8f8-4538-91db-12298c76754b", "comment": "Malware payload (DarkComet)", "value": "d271995a6bfbcad1025307af73fee7bf012898d1", "object_relation": "sha1", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213365, "uuid": "1d315b15-c986-4675-b594-80342809ca6d", "comment": "Malware payload (DarkComet)", "value": "489557d2c26848294618cc460bd90cc97aefcf2e552fc8dcb125b41dc1a315b2cdcf08945c26fb9e36baa81807a8ff38", "object_relation": "sha3-384", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213365, "uuid": "73ea6bc6-d332-4e99-8684-9573f2f4ec29", "value": "T1C5B4E0B1F144FC62E8C60DB1E11F36B117466F6AC998392F7584BD2E7CB3B45C0A291A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213365, "uuid": "cde1a24e-6fa4-41bb-a10c-4ed140b4eb3f", "value": "f2d24d034ad8ae86f9dd9c6c9707e46f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213365, "uuid": "dad27330-d78a-4c82-a446-c61f6d1949c7", "value": "6144:f9GGo2CwtGg6eeihEfph2CMvvqqSaYwpncOeC66AOa0aFtVEQfTo1ozVqMb+:f9fC3hh29Ya77A90aFtDfT5IMb+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632213365, "uuid": "20143b92-d84e-4dde-9fa3-d101db9c1149", "value": 533806, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632213365, "uuid": "9d6a3e1e-3e7a-4158-ba7e-d692a906d8d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213365, "uuid": "977180d5-b76e-4023-815c-c90b68cf28ae", "value": "86b764d2e91feeeb906ce1da88d84995e7d474d85a7d8f8932105618be8617ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "454543af-1ab7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1632213498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213498, "uuid": "8bbdb941-75e1-4d8d-8368-5c337eecec65", "comment": "Malware payload (njrat)", "value": "3ce04b085a3e3ed7a9142b0f27587b21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213498, "uuid": "c5da32d4-ef5f-462d-9514-151e89fc7fdc", "comment": "Malware payload (njrat)", "value": "883ec5f921750732339d92c7dcb6943040ec11d66a6cf9e7d7a3456a929a4b6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213498, "uuid": "6fd7c268-7031-48cf-b485-620ccf72507e", "comment": "Malware payload (njrat)", "value": "c8e1018f8fe64b80e169c8bd44eeb049516e037c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213498, "uuid": "a9b3ba86-eb9d-4ca3-9e54-3c9c48ebf014", "comment": "Malware payload (njrat)", "value": "aeb769d5b550b97808b678691218d860159023a25aa64e10126090398970d5695dbefd4a2a3f9447d5edb109f2385b05", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213498, "uuid": "1dbe6404-8a45-458e-9e2e-1c06e6f0e8bc", "value": "T1305533575C2D31BEFB0CDC31B79C1376031D164DA22568AE0EDB1BD092AB7B19EA1227", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213498, "uuid": "34abb4cf-62a5-4710-881b-d99acfec5092", "value": "d5d9d937853db8b666bd4b525813d7bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213498, "uuid": "152c5b9b-de65-4d8e-9036-9a2de9d97932", "value": "24576:+YKpJ05nnRi6ddF9d4DHi4SnNVaUN6iFZfT5jxhWUAjzFzDTTF/nk977N:KQdF42NVb6KVWPFzLF47N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632213498, "uuid": "a234a1ac-4b9b-4f4a-9fcd-1a16f360cdd2", "value": 1323520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632213498, "uuid": "0003e0c3-3092-4bb6-aea1-141c2dc13c70", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213498, "uuid": "09e8124b-05e4-4f90-b01c-52058155af00", "value": "883ec5f921750732339d92c7dcb6943040ec11d66a6cf9e7d7a3456a929a4b6e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79ccd81b-1ab5-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632212727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212727, "uuid": "2f5ef888-d0a1-44bd-939a-ac0f228f997c", "comment": "Malware payload", "value": "8e22d4d13e86da51677f67ae09a0aec0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212727, "uuid": "0323ae11-43a2-4d13-8651-e8ebbdfa57f0", "comment": "Malware payload", "value": "888497ac8f3cb030dc34d198ef8e307fab6b129f31f4fc9c41ea78f94d831529", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212727, "uuid": "09770204-5227-4d1f-9f3f-54ebdccc8dc2", "comment": "Malware payload", "value": "a69b71a21705aed2fdea04945fc44890c08e22b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212727, "uuid": "933c3252-ac70-4324-a8dd-86575f0d272a", "comment": "Malware payload", "value": "dd910c218fb782fd9a2299b84cbffcfe87236f25882ae32c103b36217a8df2ebc4312f4226352c45a20b1f8d293605b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212727, "uuid": "54a32cb3-4475-4969-a6b6-dff3c1c29d8a", "value": "T11246331533E185BFE8D32D725BFC17F691BE81085F2108C727CD679E1A38A82A13965E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212727, "uuid": "ae77ee19-ba50-4f3c-af7b-182a4d17b57b", "value": "be63889866f6bba2109402ee273e5652", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212727, "uuid": "b6afba6c-e552-4654-865e-5b3df17d6336", "value": "98304:yDoMg6ltF0fzbiYy3YBKwQFmmtNUZaB+09H6I9FawsPqSheEXW9W:ysM9ltiXiYQdFlULWa60/QEXW9W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632212727, "uuid": "935e7973-7e2a-4b97-aa0e-448cf7065f77", "value": 5738496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632212727, "uuid": "759d1c00-6ee9-4fcf-b013-2946a13f4e67", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212727, "uuid": "5154c6b4-c160-4461-8342-50708bf5ddd3", "value": "888497ac8f3cb030dc34d198ef8e307fab6b129f31f4fc9c41ea78f94d831529", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b02b5630-1ab6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1632213248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213248, "uuid": "d3e928f0-7b66-4eb4-8106-3f4a3666127b", "comment": "Malware payload (njrat)", "value": "c19deb53070413c02b1cd03ae424bb1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213248, "uuid": "9a709d0b-57e1-444e-b927-5a4aa26700a8", "comment": "Malware payload (njrat)", "value": "89c72522693c171fc9db2f0ef8412fe6881ec0103ffd8edb0e0427fd68fc7fde", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213248, "uuid": "0b89386b-f6d6-4a3e-ba13-3bb88dcddf29", "comment": "Malware payload (njrat)", "value": "b87d4f4fffb60627ec9c7ced3dbdfc945e7a0089", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213248, "uuid": "8be035f4-8602-42e7-ae5c-db5d3f339fc0", "comment": "Malware payload (njrat)", "value": "9bb7325bfd9e0e9493ebc7eb11a3fc526f044d82dbcc061ebe16aaa1f1a149bb2d136d7b758166de4aa8691f785cd9c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213248, "uuid": "63079ef1-5016-4ab3-bf02-d07a3f47e6a2", "value": "T164D3CF7A2122FFEAE53E0F71F42028505FB5B557A372C62EFDC5069A18639D08B126A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213248, "uuid": "56a511c7-edcf-4d7f-973e-a46c2871ae7b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213248, "uuid": "7728c8e6-cd96-457a-8aba-f976f3880976", "value": "3072:0Nji1zLkTvFpDpJ/1vtO32GhNvOCmByk4u5v5c1smXzI:0pSzwpl11c2GhNIBykAxX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632213248, "uuid": "edfa23c2-6098-4f9c-a986-fe51141df6e5", "value": 138752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632213248, "uuid": "32f4fcaf-c2e7-4aa8-bc7a-3e4fa29e838a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213248, "uuid": "2472ce99-f3ba-41a4-a955-9c4ee907fbb4", "value": "89c72522693c171fc9db2f0ef8412fe6881ec0103ffd8edb0e0427fd68fc7fde", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82c20834-1ae1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632231640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231640, "uuid": "eb1dc0d8-e475-4b71-85fe-9fa8fce4b413", "comment": "Malware payload (Formbook)", "value": "4a1f2305b60236d5c00c871a92a9a693", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231640, "uuid": "2115b328-5fe9-42e1-8ab1-cf8bd5605f23", "comment": "Malware payload (Formbook)", "value": "8a95ac711537aeb1c93c61e541077005f5226e4150c2669742d1b612cfc25788", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231640, "uuid": "818dae27-9353-4adc-9847-30c050163aef", "comment": "Malware payload (Formbook)", "value": "ca9c84820c9960d0c294e684be2acb11736ccfd1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231640, "uuid": "6f7fc5eb-40fa-4cf8-a6e6-2c3d27aa96a2", "comment": "Malware payload (Formbook)", "value": "006dcb1448ebb17573c4e5cd5ce59b723e2d4d40ff7efa3bfec643a3fb67ae0a82f34137a615f72a6e7d9d0ca8f16d33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231640, "uuid": "338b4c9f-045d-4c83-a773-a81f4e88f299", "value": "T1ED44125372F486B4D1E7C1B19C7766FBF377514892A53D4B43E42E3A282D24A4A0E3B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231640, "uuid": "48385cfe-92de-4710-8bd5-0b6ab62f9204", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231640, "uuid": "332096f7-10fe-4b3c-b2fd-633face8e4be", "value": "6144:58LxBU0fQneEH94yoXvj9fucOuE2Slz4p9CvEeDSGKDq:P5neEd4yOf9OuE2K4jC8OSGKu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632231640, "uuid": "a86aba2b-335f-42dc-8cbe-0cb24664c5e2", "value": 255800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632231640, "uuid": "60b210ad-0884-4656-8ac6-fc82a47a6178", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231640, "uuid": "a3fb701d-0aef-484b-b27f-591ac72bdb0c", "value": "4a1f2305b60236d5c00c871a92a9a693.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a85c74f-1aeb-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Quakbot)", "timestamp": 1632235841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632235841, "uuid": "6bbc2cde-bdbd-4c89-8ddb-00f06b8f693e", "comment": "Malware payload (Quakbot)", "value": "1c994d8744d0f99611ab6d6ce1408676", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632235841, "uuid": "37ca8d47-1995-4a8e-bc74-cd8040b98621", "comment": "Malware payload (Quakbot)", "value": "8acaf6397134ec184063a8ba2a14d4544d3e8f6d5d38f5e1a871fa0b77ea5431", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632235841, "uuid": "a20fdb73-a3b1-4667-9600-c33e593e28b9", "comment": "Malware payload (Quakbot)", "value": "ca42d5c427b13e8bafd90a406450bb076d0307e2", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632235841, "uuid": "e02e8dce-6685-4228-b17c-9c8967ff15c0", "comment": "Malware payload (Quakbot)", "value": "b58c7382e798505620ab30561f40b66b012053f91a73621cd37bd3ba1e92ddb289ada37616d4b061c32a3bb8b414d706", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632235841, "uuid": "ebd927cc-48d8-4cce-9c41-d980f1e63b83", "value": "T15B149257A9058AC3E51C93F8BE434ED92F066F08E9563EEB21153F8A7F742530D8A11E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632235841, "uuid": "5bdde688-b09a-4411-b18a-ac319a69d7e3", "value": "6144:AKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgOSrofSHq8oD5u:Y1F55u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632235841, "uuid": "233348c3-89eb-4ab6-9190-5f0f99ddf67e", "value": 203776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632235841, "uuid": "0a548cfc-7f06-456e-a044-1789fc7af7cf", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632235841, "uuid": "fb510bfe-850d-4117-9e6f-cd12c7ed4cf1", "value": "Payment-1353662366-09212021.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc71e15a-1ac0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632217590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632217590, "uuid": "274d8010-9e39-45ff-addd-e29c0deada84", "comment": "Malware payload (AgentTesla)", "value": "701a896ea77f3f0f1bdb31c6b10fe4ec", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632217590, "uuid": "48bdca02-3bf4-4e11-a3cc-c1b693336975", "comment": "Malware payload (AgentTesla)", "value": "8b5eb6f236407581c214f8f2717e2376bb3ee2a00295e8be366aa798fdec2f0b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632217590, "uuid": "8041a858-4a71-4cbf-9b8d-611968998b78", "comment": "Malware payload (AgentTesla)", "value": "b7aced5fc15f5d6ec2e3fcdbd33be2f57d167799", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632217590, "uuid": "e9929af2-488c-4805-bdec-5286b9095905", "comment": "Malware payload (AgentTesla)", "value": "f059e916e7cb8fb0477775adf5ba92f100597d948a962ffb4c0469dcf805eb8e423f62499cd9e96249530a7330bc54cc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632217590, "uuid": "bb8cbfda-5e04-44b4-add6-26268bd46449", "value": "T13182C67CC05B06A88F8697B82B1BAF05058CB66EF3889272727C5B3567D5D3B111783D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632217590, "uuid": "1fd6a64e-3499-4dbb-ad5d-60c2d9a64fc5", "value": "384:T8Bm9xLmQEMNLcxd4J3bJxYcD1cCpIkgI/6XEERrF0KHkXJ6Y3jqLRvaF43ELvT:AU9xLme6xq3YKZpWIyZjkwF50", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632217590, "uuid": "4672549b-1ed6-46af-aac8-e6a60be3df2a", "value": 19284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632217590, "uuid": "d34b491e-44dc-4b75-8bc5-f4bdad741019", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632217590, "uuid": "bf0d42c9-2cfb-4108-a6c8-91d001c36f51", "value": "DHL BL2021764774AWB.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31ab3871-1b24-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632260280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632260280, "uuid": "bd277027-b4f6-4624-b5c6-5e919121beab", "comment": "Malware payload", "value": "b5d2723632831c7b410b9ef97d36d00b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632260280, "uuid": "e60b4fb9-3dbd-43bc-b641-e50c585a8e4f", "comment": "Malware payload", "value": "8b674006b8b5314afe05afeb49a9bed86ae53adcd8caa277d5caf5c9a725829b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632260280, "uuid": "22944532-dbe6-4a5d-942c-cf0af64ad7d0", "comment": "Malware payload", "value": "c7cdb7ea0828dce9acff6d002945638b2abff124", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632260280, "uuid": "c4f58c92-1e58-40fd-8424-f432048182f1", "comment": "Malware payload", "value": "5919080a01f6ee715204a1d47565d1811757c0926909c6a3393d4210a8ac08cc3f13e3ec6b1d4c7c532e2fccae029f1f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632260280, "uuid": "187eedef-de28-4105-9df7-3b5444f12232", "value": "T178152211B2ED8258D38D7B74256663407B33BEB71833866E5ACD70CD4A33B844E71B6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632260280, "uuid": "586c523b-d361-4bcf-bb89-dd0b575edf0d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632260280, "uuid": "19128a36-8a4a-48c8-926d-9142f57b39b4", "value": "24576:Jbw8eGG+FoS+OVGxbT+cGFaDpvjGSdvhJtKpuPITbaYyN:746oFw+X+9FaDhj9MbaX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632260280, "uuid": "22621402-48b1-4275-a4a8-ec6b42aef7fd", "value": 934400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632260280, "uuid": "5b4173e6-5877-44db-85ca-cc6e6243de2f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632260280, "uuid": "2eee0d69-2711-4891-813d-4a3491b18d39", "value": "rOz6omkS6Wba5EJ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bfeef43-1ab5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1632212758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212758, "uuid": "81a5febc-2dfb-450a-a41f-253dd2125a5e", "comment": "Malware payload (AveMariaRAT)", "value": "0455d7d08ea3af13f27a040b2c239530", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212758, "uuid": "661d7f2b-8781-4a17-92c6-0543f4804659", "comment": "Malware payload (AveMariaRAT)", "value": "8b97edb9befbd1947986f08a580e40a173cd3989ee7e75422188227b3559f927", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212758, "uuid": "ce2d8b9b-1949-4dee-b474-02909e92d2de", "comment": "Malware payload (AveMariaRAT)", "value": "505e738f69f5c826feaa5457fe93c4485eb985f7", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212758, "uuid": "b5f2c135-a9e8-40f8-a74c-0d54aefd2dfc", "comment": "Malware payload (AveMariaRAT)", "value": "9f4f7935b18912649212328b81cd36125ac00d7dff2e9ef4705b28280a44f8e37a57c2491c4827a0dae9e4643895030f", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212758, "uuid": "82c54651-c65f-4636-9b00-729cd0bef1d1", "value": "T1CC261254B55EFAB9E40ABBBD54E32247530E6F80EB5DF2F320C4E917054BB6846B3482", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212758, "uuid": "af6d6b6a-c3b1-438b-941f-9d608f8d4eb2", "value": "084fafd5fea9d39b4ff35f2d82f0908b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212758, "uuid": "8dbe5c08-56d9-4179-9862-7c0f08c12d19", "value": "49152:Bb+IXDDExkJyxa/4YZH23/fjKFQs9u/s/PfbJit:UIXDDxV4+8/fjKFQs9u/sHzJit", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632212758, "uuid": "72e86e5a-433d-4507-8769-f490bc5ce977", "value": 4675617, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632212758, "uuid": "bcb792c5-0e99-4a2a-9f96-c123ad4576e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212758, "uuid": "1dd1335f-1a8d-47b5-901d-b4b6f5a8291c", "value": "8b97edb9befbd1947986f08a580e40a173cd3989ee7e75422188227b3559f927", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7341cab2-1aa8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632207133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632207133, "uuid": "d2b4da3c-1f60-4087-8e28-4be3473eec76", "comment": "Malware payload (AgentTesla)", "value": "fb27a11ab4e25b033d8f87a93fd59ebb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632207133, "uuid": "1d0149d5-e9e3-498d-a93c-8a4ce0fd6859", "comment": "Malware payload (AgentTesla)", "value": "8bcdd57e74a7616cc0010c44535096382c2b68ae0c695148021065f25c7891a1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632207133, "uuid": "55cff379-fc96-467e-8979-7a0035b705ce", "comment": "Malware payload (AgentTesla)", "value": "5d4d08d9aae576f47baf327e8c295ee7b1baddff", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632207133, "uuid": "47cbdd42-488a-428d-a378-8ffd8d23f110", "comment": "Malware payload (AgentTesla)", "value": "fc62ec1b546cedfd7bd4ae50937fe6327f8ab14413ec296e24fc4ddf33e701367e0bc3c17065337fff0241e93c4fb906", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632207133, "uuid": "ec9d2dff-18ab-4a75-adf4-1bcdb658b2bb", "value": "T178157C394D2682F787EEC66CD08C1FCEDAA6A4837B919F1AC496D7C2025770FE49845C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632207133, "uuid": "5282f108-ed4a-4697-b710-c4a7e49f6931", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632207133, "uuid": "7c6eb4f8-9cc1-4a4d-a316-6f5114c740ad", "value": "6144:0o2+zAmbPNPT3bEtxX8Mg/bXoIPS1wlPgMTgFEO7Sj76N90yhuuov:0EAmbJT3ShAbRzNonN9W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632207133, "uuid": "e2fe244b-b2b8-4da6-94de-b569843ca366", "value": 891392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632207133, "uuid": "5b17d57a-633d-4c4e-ab8d-b05f611a0580", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632207133, "uuid": "b9582cf6-fb66-42bf-abc4-d1e5c116cdfe", "value": "Purchase order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25a3147a-1ae8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632234490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632234490, "uuid": "c453d503-5820-43f0-85c5-7e189043b828", "comment": "Malware payload (RedLineStealer)", "value": "3dcb3e84135c33dff6d6268e939b5b82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632234490, "uuid": "45f1e7ae-031b-4fa9-b791-21cd8e5b5adf", "comment": "Malware payload (RedLineStealer)", "value": "8c691146104b754406321f8707741ef9ea2b1ed3b8cdfc9b017e9d2b154f41a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632234490, "uuid": "c091df5c-4eac-4521-b2c6-daf414b7fd9e", "comment": "Malware payload (RedLineStealer)", "value": "e6839d2990f40641c8109aad9b47c1e5ce6681b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632234490, "uuid": "2ed3005f-713f-4e91-9d2a-9f85fb2b2eb3", "comment": "Malware payload (RedLineStealer)", "value": "18875b3f12358ea29eb050bf0d79d4976e41bd3f39b77026e624d54c0964f23f6521d333ae720058f0c12aa3a72a59cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632234490, "uuid": "4931461f-0cd9-41d1-b857-07e78d47d0ef", "value": "T12694242868BFC01945E3EEA52DDCA8FBD99A55E3640C703701B4633B8B52B84DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632234490, "uuid": "4c9dd55f-8afd-4ecd-917c-9d54db175a25", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632234490, "uuid": "30774b49-81e4-4fb4-a8a6-6f5d07b3d6cc", "value": "12288:BklT97iiPO14xAjh//g29Z8B5EOHJCuy2Wf8GAt3hiortiaj6PDY+XZGbml:EijhQ0y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632234490, "uuid": "5156107d-f44a-441e-b67f-88897bde551c", "value": 445952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632234490, "uuid": "bc7a8f9b-6753-45cf-8f59-08827afa7835", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632234490, "uuid": "d7e5d6e7-3360-43e6-b9f5-ace5c598112a", "value": "SecuriteInfo.com.Trojan.PackedNET.972.13410.18492", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e083d12-1aa4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (GuLoader)", "timestamp": 1632205406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632205406, "uuid": "a9563d56-d8b0-44cb-872d-dbffba3622d8", "comment": "Malware payload (GuLoader)", "value": "7dfa0082f22f873e2ad29ef976990053", "object_relation": "md5", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632205406, "uuid": "70983c14-0255-4256-8d24-575e1d241e29", "comment": "Malware payload (GuLoader)", "value": "8e2a99ff20b7338a8c60a779b0c7c7c33da535e6e8dc3d80d91f40f6da441144", "object_relation": "sha256", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632205406, "uuid": "d6ee817e-ed19-4613-b8bb-050607c79063", "comment": "Malware payload (GuLoader)", "value": "179b62282f14f8a4d6c4d3a981a42439f0219098", "object_relation": "sha1", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632205406, "uuid": "481cc55b-9a8b-4b10-86dc-0b48a6200cc0", "comment": "Malware payload (GuLoader)", "value": "8d05e5da42327092c450824d308f4487a94ed99e907504068566c513d2c47b49cf46afa3664f6c4908babe7916813402", "object_relation": "sha3-384", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632205406, "uuid": "226f2497-7309-4fca-abab-7ec31b28cfb4", "value": "T1C2A35B4171B0E444E0EACB7DC9AD8BBC4514FC47C9225A6B2D843E5DFAB1F06A29D12F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632205406, "uuid": "d8aa74f9-31d9-4738-b16a-1d2732ebdf6f", "value": "46a3f7ddb0f0c8119624bc2c421c65ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632205406, "uuid": "f2ed12c6-23d6-433d-abae-b1078db4c650", "value": "1536:ADwQ3o+k3w0JVADq6qdsNlIJihvrTC5E9vish67DK2VvxUaF:AUa4lbiPIJihK56m7fVvxLF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632205406, "uuid": "697946b5-a99e-4614-a2ee-7f82948c97cb", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632205406, "uuid": "bcd10052-9ff2-425e-be12-2cb7f575a8a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632205406, "uuid": "ffbba0fa-7234-42cc-8ef0-69846bee031a", "value": "FACTURA Y ALBARANES.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcc79195-1ad2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632225349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632225349, "uuid": "1b3ad41c-9ca5-41b9-a0a9-774ba450e514", "comment": "Malware payload (RaccoonStealer)", "value": "ccc61ab8808223222d72075ef05824bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632225349, "uuid": "db67aff6-a626-4a28-8544-daa296832c22", "comment": "Malware payload (RaccoonStealer)", "value": "8eef033f451d0f80979ba8cfdcd79677c475cf34a8337c54af16895defbd88b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632225349, "uuid": "b9f84ac2-ae92-4485-9f48-84c559bf2ed2", "comment": "Malware payload (RaccoonStealer)", "value": "464c2ede535b9b20a4a78c70ba1bc42d7a2881f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632225349, "uuid": "359bd3e5-3ce5-466a-b9ba-7d48692112a9", "comment": "Malware payload (RaccoonStealer)", "value": "2fb9089d9e57bf60ef7b0bcbb1ed4f7f6581a7619acc5f7674fcea03da1d2c22baf1fae2f870f0d1ffd378db019cdc76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632225349, "uuid": "e7252c09-cb1a-408e-84ec-362fe9adcbc3", "value": "T103B401003BB0C671D29356310B27E7B0A9B6B9612E7193873B56F67DAF302D0766731A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632225349, "uuid": "cf96b65a-bc48-4512-b497-89b9d6ec1613", "value": "019bced73b51911db702af2d47c34cb7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632225349, "uuid": "38f7c52f-c410-4f76-83ab-2eb2709257df", "value": "12288:Dn5fNE4KqOmutSvfUCq25T/ZOcQNwpMjRCzegsG87A5ptWGBai:lHNOmBvfUK/ZO5NnCzBsG8c5Hh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632225349, "uuid": "4154bd14-c472-4563-aa05-07478b661185", "value": 497152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632225349, "uuid": "fb838aca-9e3a-4d64-9bac-707c123c13d8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632225349, "uuid": "f197453b-62a2-4aef-b46f-560d05ed80d9", "value": "8eef033f451d0f80979ba8cfdcd79677c475cf34a8337.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7587d850-1ab5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632212720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212720, "uuid": "eafad1f3-fb45-4d58-873a-3f71288ed8a8", "comment": "Malware payload (AgentTesla)", "value": "c760bd91023612230944f1ab34a65294", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212720, "uuid": "c3c5d61d-cd50-4e51-b3a1-cc111679680b", "comment": "Malware payload (AgentTesla)", "value": "8f5c6b77e087af2abe417b53fc62f3cbe7a2e1250e053b93401fa8026aa7f0af", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212720, "uuid": "5d05692b-71e2-4478-8ea8-4696e5ba2d9d", "comment": "Malware payload (AgentTesla)", "value": "81c9634f33fbaf5f2005042f91c94404c1de7634", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212720, "uuid": "b4780f11-02e7-4b96-968f-a7801abc9781", "comment": "Malware payload (AgentTesla)", "value": "81e451ca47f932aeb1478c948f0a4f4ba7a0ee329d271c05aa51dcda76a58a39e0eac1da5292c580cb3a271a42016526", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212720, "uuid": "7d38a6e0-7cca-4a38-8d02-65dd3918590f", "value": "T154F49DD17D47D89BF4DF2AB398AFC0201164AD8D9165C73D26967A2B54F330230ABE4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212720, "uuid": "feae7d8b-5c3e-4e89-aae5-0e48e6c1f53b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212720, "uuid": "8baf0495-e7c4-4028-aa2d-12f12fbc8ae6", "value": "6144:Q9ETqmKQluNmtiS3/NpZZaUZ9wC0uBknu9F6YPDTWhJBw1U6I+7BHga2FWSEPokA:1hKQlsmtiK5oUZEuAfy1F3sHZHNoGQK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632212720, "uuid": "6f925871-0c09-4bbd-93f7-030d6db240fb", "value": 793600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632212720, "uuid": "86c6776f-1f6f-4172-82e3-12e7bb4ad11a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212720, "uuid": "f22a7e5c-a239-4790-927a-6835c32a1c14", "value": "c760bd91023612230944f1ab34a65294", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa438665-1b17-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1632254899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632254899, "uuid": "4aecf04d-c389-4b84-a2d3-6b626896d0ba", "comment": "Malware payload (RemcosRAT)", "value": "cf98d2d4d4555323842c8371db09347e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632254899, "uuid": "903169fa-051f-4bd6-bd8f-aaa3b8f63c74", "comment": "Malware payload (RemcosRAT)", "value": "8fa72e87addead9671e573d7cb843ca784a10cfbf6acf5b6bc4830df66fe0bf0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632254899, "uuid": "1b52f689-18cf-454a-81b9-85fd85fddfca", "comment": "Malware payload (RemcosRAT)", "value": "2bd28f09d3ea7c08bae3a90dd32c28335488eb43", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632254899, "uuid": "abf82331-de31-49e6-afb3-679418de2899", "comment": "Malware payload (RemcosRAT)", "value": "c2f02b49e9ab66a2b0ad1d1619a227148305d38d0093a54ae3e5f71d1255f797441537da59414feb4e20422d5565803c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632254899, "uuid": "7007724a-a529-4ffd-ab5e-8edb4fd35f14", "value": "T1D9356BE77399CCE5ED213A3DFC46325223567BF538421C0D9DB07B8A2679241B86A84F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632254899, "uuid": "49573fd6-a36d-45de-87a2-2b02588dfd69", "value": "bc8cc1eea5c25ce2056d7da92bd98134", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632254899, "uuid": "e07a1a2c-7b33-4241-93ce-9dd41dc303ad", "value": "12288:lIspEfnP8N/seflQTshT8aqeTW39KqyeoAdrL7SUbDz5Zp:320N/seflZhTmiW3AirPzz5Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632254899, "uuid": "0d930ba6-8ff3-43a3-910d-11f8f7f93aba", "value": 1133568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632254899, "uuid": "bd6afd99-6941-491c-9791-74f162277c00", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632254899, "uuid": "b25e257f-d368-4dc2-92b3-8b6ec93644b0", "value": "cf98d2d4d4555323842c8371db09347e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95c467ce-1b08-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632248422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632248422, "uuid": "a9688ebe-47b1-4d17-8b66-2946fada9781", "comment": "Malware payload (RedLineStealer)", "value": "814df8f200c81d83460ad17cecfcd04e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632248422, "uuid": "69a7bf77-0921-4f14-8b28-2b8510c45506", "comment": "Malware payload (RedLineStealer)", "value": "90caa73c73612ef1e633f52a779c85bbb97329cea02388297607befbf4c614cb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632248422, "uuid": "4a6b456e-460e-4c72-a8c7-9f15f3a6f082", "comment": "Malware payload (RedLineStealer)", "value": "9bb6b2fb3ed77a46ccd28f44282cdb39337709a5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632248422, "uuid": "0936d588-d7fe-4fec-97a1-fd6b62ce6d2b", "comment": "Malware payload (RedLineStealer)", "value": "8b72d08cf899084ee9c28232699d59fe5791326dac8c89d0d2e61c6c7643b515314a0cdfbc9bf2bd735ec5545ec030be", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632248422, "uuid": "a6a97524-db7d-4a4e-9466-985fe604dc69", "value": "T1DBF507E0250F9D9FC2064CB9A5C79903A33523E58A21D807E9FBB47BBDE3C912D94B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632248422, "uuid": "cd10f04f-00dd-453c-a680-14457991283f", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632248422, "uuid": "39498273-2e3b-4bf9-ae36-de083bd6c06b", "value": "49152:Wev+otZHGa4hJEsGT/q7Djn4vN4+4s+cP5Mp:Wev++AEswS/j4vN74s+YS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632248422, "uuid": "9336c030-abe6-4c88-b3f3-707b687fae5c", "value": 3561816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632248422, "uuid": "2299a6b1-44e0-4c63-91fd-395ec83d3bc4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632248422, "uuid": "18c9c29e-5969-485e-a2e9-426efc713f76", "value": "814df8f200c81d83460ad17cecfcd04e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6d1118f-1ae2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (GuLoader)", "timestamp": 1632232157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632232157, "uuid": "fa19f114-d94c-4ba8-b8f9-3b1548b87069", "comment": "Malware payload (GuLoader)", "value": "5985806fcd73f3477e16b5361884d122", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632232157, "uuid": "6e67bf80-13ad-4929-b2c4-328e71e835a2", "comment": "Malware payload (GuLoader)", "value": "90ed5f0364938d76c400cdfc500d1ff3fc9c07e8bf9b7c2a96437295e9e503f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632232157, "uuid": "f5601011-4700-4418-b85d-9fd35ab7796b", "comment": "Malware payload (GuLoader)", "value": "5307b149028b85e914bf243536e34161cbb2d958", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632232157, "uuid": "6d4f83ac-974d-40d7-97f8-593b4541a5b3", "comment": "Malware payload (GuLoader)", "value": "6bc9390c10e75d2192edc1f0f3794266c2246ccb43015539144e13e7b8d5e8e1b79b34210928b342715f017d14a9946a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632232157, "uuid": "66755a90-d2e0-4083-8269-6642db7051ee", "value": "T103A33B1231F1E444E0DA56BDDEEEDAF84020FC57E9265A5B2C443C1EF934D82A69E12F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632232157, "uuid": "63e6379f-4870-49b3-a200-7d036b31f9c7", "value": "46a3f7ddb0f0c8119624bc2c421c65ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632232157, "uuid": "8b660938-6f4b-4ed4-8b05-e07a8ef3e816", "value": "1536:xDQBl5kG1dJCNpSO27S+umLpGUrd3fmXX6nhYNfp2oDK2VvxUaF:xEB0GQNpSO23BpGxeofVvxLF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632232157, "uuid": "7158b79b-b617-4abe-9684-99e8a892cb76", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632232157, "uuid": "ba82154f-49b7-4dd0-9bb4-266235082236", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632232157, "uuid": "2b08b92c-243b-4ef0-a079-494fbd671ce8", "value": "sprogr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04beeea7-1ab2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632211242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632211242, "uuid": "158d4bca-eaa6-4cca-8b33-e4cd05342fd3", "comment": "Malware payload (Formbook)", "value": "21ebbd592e50341c7dfdde85bd801fbc", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632211242, "uuid": "970133a6-0c50-4b53-9fec-c321c11d7873", "comment": "Malware payload (Formbook)", "value": "917256cc05e973907b1b96166374b2a31b2cba9c328c1a79a8bc1e50f2979bcd", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632211242, "uuid": "5b78c59a-ba94-438a-9aec-adf136383815", "comment": "Malware payload (Formbook)", "value": "b4421c31784ecfc4b523f77fa0ff804fd8920dcd", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632211242, "uuid": "59eb0be9-731d-432a-978e-d27a3edd6008", "comment": "Malware payload (Formbook)", "value": "df7a423e8b5ed505a55e7209e9c5ea200edca2ec6939b1d6cb30fc0e3aea54c00da03dbbd42758363abd7e4cec3cecb8", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632211242, "uuid": "1356f915-5d54-444e-bcc3-e6e2ce3cfb29", "value": "T112D4F1003ACC8A5DD8FB127298AE21E1E1ECEDB7DAD2D50722F170BE73B560513B6149", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632211242, "uuid": "fdfcd9cc-5bf2-4c17-aed2-fe6403535c42", "value": "12288:yLNEl+Bvg/VjCC8zKKn/pW5OlqyoMpDpm40tjMSh:yL+yg/VZSlqOwvQwNMW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632211242, "uuid": "f0ddd6d0-6364-4950-9671-f3a281952988", "value": 602120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632211242, "uuid": "d43cbeab-418b-429a-a0a6-f651c6f89c4c", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632211242, "uuid": "ab34d030-ef6f-4416-9597-0cf2422b1cb3", "value": "001_Shipping_Documents_information_092121.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ece2747b-1ae6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632233966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632233966, "uuid": "40bcacf7-412c-4bc9-9436-12f9b1bb330d", "comment": "Malware payload (AgentTesla)", "value": "4f006a02c107926ed24fc45073334b88", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632233966, "uuid": "d452e1b6-cd26-4428-afe3-bb762f64e664", "comment": "Malware payload (AgentTesla)", "value": "91ef6e228367a06c21a66242951db031ab3bc32a4a847411bcc40877ade69026", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632233966, "uuid": "dd659bb8-ae10-4502-ba4f-76d989ae5f7a", "comment": "Malware payload (AgentTesla)", "value": "859729293b6796deccc06730383064f9fd9cfd3e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632233966, "uuid": "43e34aa3-d554-47b2-8490-3db92fb4ec54", "comment": "Malware payload (AgentTesla)", "value": "8caf122fe227c30d3fd473b037bb2c512a37790d5eb87f2d449c292f7cc6a2359aec9a335da2b96ab4f243350ea6e50c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632233966, "uuid": "f105d2cd-7c0f-430b-8f57-e5a777520eb6", "value": "T1A7D4021171DE0658DBE977B525B193103B37BEBA5873C60E2ADCB18D4B372818E34B26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632233966, "uuid": "93147518-3467-48fa-996d-ac164a803f11", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632233966, "uuid": "1dfab067-5ceb-4184-887e-58b7f2acd056", "value": "12288:/cIbw8eGGmtiK5oC5cosHzzmVIxljbUeRfFsP0Uy1r4l:3bw8eGG+FoC5cvHzyVyFQebRUy16", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632233966, "uuid": "f77a8cc5-e449-4a0f-bcf7-2a05ddd509b3", "value": 626176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632233966, "uuid": "f45fa666-4460-42a2-b0ea-6ac5962430cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632233966, "uuid": "4c62717e-b031-4976-b7c1-fe74941642df", "value": "4f006a02c107926ed24fc45073334b88.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5a84bb4-1b11-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632252368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632252368, "uuid": "b8d199bd-b424-492e-8dce-94e9da576e92", "comment": "Malware payload (RedLineStealer)", "value": "ac2dd5da927ece20fe2164f7adcfe30c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632252368, "uuid": "b03e8ce7-5a0d-4f39-ba1a-54a4ab839275", "comment": "Malware payload (RedLineStealer)", "value": "92b230998990399e6c733b38d0c023236c9311eedd99f60e294a4ec43b6cecd8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632252368, "uuid": "d351787b-ff07-41ce-bc0d-29e047515ba0", "comment": "Malware payload (RedLineStealer)", "value": "1a390f3c0a5592978986518a12dd1ca28822e266", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632252368, "uuid": "3f1d1000-336f-4c22-9bc7-992abdff9bc3", "comment": "Malware payload (RedLineStealer)", "value": "ed26daf62253c9af680835c0e401346bdffcf2285e8f523d5bed76b6a02013c4869721add4c5954b45949d05cb8ff61d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632252368, "uuid": "5e3286bc-a934-450d-bb09-ac22dc7da5f5", "value": "T185F5F7A03EAEB5CBC1D60874F6E7C602B71872F17022ED43D8A9747DBA93D425AC5349", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632252368, "uuid": "3eed9436-5152-412d-9284-7ce83790a126", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632252368, "uuid": "0d956645-771d-455b-8af5-0c6da7e08cea", "value": "24576:OeevPiuIl11MlVjJPsQezw/bXchYlMFQW3apC67JiMjjRYQ3vUNwvGkd3+rpTLg2:Oeedu1CrlsHLgjXU8+vws", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632252368, "uuid": "afda473c-7633-40e5-bbbd-f4357041e250", "value": 3448072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632252368, "uuid": "b3b01db8-4e74-40ca-92e8-1d2929fee40e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632252368, "uuid": "7102c226-0f78-4e6f-99b0-d7532a6a9f1b", "value": "ac2dd5da927ece20fe2164f7adcfe30c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9d78db8-1b0f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632251462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632251462, "uuid": "fd42f982-400f-474a-844a-d0a4881d54af", "comment": "Malware payload (SnakeKeylogger)", "value": "91866c015ef7ba99a5f145fa4be4a08f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632251462, "uuid": "1435b55f-0c70-47f1-bad5-44374bdede88", "comment": "Malware payload (SnakeKeylogger)", "value": "93f90bccb214745fc85c202b48542fb71f654eeb8d2b5c73d473f27ba0daa6a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632251462, "uuid": "07266ad4-4685-4f72-b4bf-92de870f5a03", "comment": "Malware payload (SnakeKeylogger)", "value": "375576b506e5ea0b511a682d99890c57376064b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632251462, "uuid": "3d732b06-8612-4321-92d8-141c5647a95c", "comment": "Malware payload (SnakeKeylogger)", "value": "52e78d8c7f23a336a3edb13e71067b57a5cfae1ec49b3f37ae428de803d610457b86790e99d454f1e9a750a8927d30f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632251462, "uuid": "07f3a4f1-195a-4be9-9b66-20eb95cdeeb6", "value": "T1B7A4123883A88675CA68EFBF706041414775738A3503E77F9FDAB0996E1E3A250518FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632251462, "uuid": "6bcf1b26-c779-4e51-85fb-52f8183253e9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632251462, "uuid": "d13d69f3-b740-4b96-b32f-4d16efe502bd", "value": "12288:5As0mtiK5oBDKbWFyl+k9S1STVkWRrSVqFrsJhH:y+FoBWaFyB9WSXRWVY+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632251462, "uuid": "9f076e58-db4a-4277-8fc8-964a9d9297f9", "value": 465408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632251462, "uuid": "302ebb59-33b7-46c2-9306-49c04880a465", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632251462, "uuid": "d3ca8a3a-9b55-43d5-8cfe-1e5e0d8f8268", "value": "Quotation -Scan001_No- 9300340731.doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a892a16d-1ade-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1632230415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632230415, "uuid": "f6d437ea-255b-4e19-9410-eb23b2fe51ab", "comment": "Malware payload (ArkeiStealer)", "value": "a798ef57e3c85cb91b48f8dca990e5fa", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632230415, "uuid": "d191f9d2-b85a-439d-8c68-a80ed70b5ba1", "comment": "Malware payload (ArkeiStealer)", "value": "9434421e8f743533a557a717bd9fc444b5047c3c73848029762068520ec9fc26", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632230415, "uuid": "b04de923-dc2a-43e1-913f-d972d23af3fd", "comment": "Malware payload (ArkeiStealer)", "value": "59937f93d10c728f5ec5bd29bd2c18be70dcd5f2", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632230415, "uuid": "69ade6ed-bc5a-4e87-8a83-41144da81b07", "comment": "Malware payload (ArkeiStealer)", "value": "42712a223ad3937dc87fdd4001584313294f1b835177c7dd01fcc37ff27375894a41962aeb659568302295d1331cf9d1", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632230415, "uuid": "8a0a5fcd-e72d-44db-97b4-7e453cacb38c", "value": "T1B614CF117AD0CBF1E56701704760EBA86A6AF87159F04B8B2B47327EEF342D0772635A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632230415, "uuid": "a915b05c-c122-4fbc-8434-bfc0c9843f20", "value": "019bced73b51911db702af2d47c34cb7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632230415, "uuid": "be04d96e-e16a-460e-a175-5a68b354e4ec", "value": "3072:joxZnjBWTk8Jkf5mnGKm9TKgC+iDfCKaIxAwjtqAG8:YBWJ9GKATKg/PBwjtw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632230415, "uuid": "eea43e74-d4d1-4107-85fd-12a62b322c3e", "value": 204288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632230415, "uuid": "ba68b5f6-14f1-4dd4-9d76-0252bf9fb314", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632230415, "uuid": "ee945cf5-d9dd-4460-ad2f-af1f1037113c", "value": "a798ef57e3c85cb91b48f8dca990e5fa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73f14fde-1abb-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632215294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632215294, "uuid": "e277ad47-aeba-4ce1-b896-256f8d31c710", "comment": "Malware payload (RedLineStealer)", "value": "358af97491dd7d9191744789b0f9e87f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632215294, "uuid": "66eddbd4-8886-4b79-bb68-65869bc9547f", "comment": "Malware payload (RedLineStealer)", "value": "94b889520eef8ce443319b1a145245f8aaa3c1d34baf6cc1f9f6980dee98966b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632215294, "uuid": "b0230f70-b276-45e2-883c-c89e7469bdb7", "comment": "Malware payload (RedLineStealer)", "value": "45a17f156370301a11e958416f155b0897bdc1a6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632215294, "uuid": "04be87c4-2a8d-4be1-ae2f-824308fb2354", "comment": "Malware payload (RedLineStealer)", "value": "53c5b872a46756470b3b2e12dc26ecdfe4a07512b25069675edcb9a7915775df2f693fe3d373dc883a6ae80d74196019", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632215294, "uuid": "3bc0eca8-87c2-407a-89a3-be32b0154e03", "value": "T1E2C34A2553DC8B28EBFE0F757071121147F0E19B6102EB6B9DC1ACFA5E32B426B506E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632215294, "uuid": "ab1ffd6e-24b9-415c-a9f8-5e990e18a8b5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632215294, "uuid": "f47431d3-8c6c-485a-9828-5749c991d159", "value": "1536:2e1F1b17Sn8b/BKrziXzumoL6jbuRGdqnhlyq/dBVwdbknEvG6qTaoigRvmVo:r3JWz2z384vqnPyOdBQkEahvmm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632215294, "uuid": "1d385f48-1466-45fd-acc1-9107fd9d08a7", "value": 119024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632215294, "uuid": "b15ac776-f150-47a1-94d3-7d173db1b77c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632215294, "uuid": "6597839d-28ec-4c0f-93fb-bf1d3ef557c1", "value": "358af97491dd7d9191744789b0f9e87f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1260df04-1ab6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632212983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212983, "uuid": "3518f212-e965-4fb2-a896-cb328f9a1b20", "comment": "Malware payload (Dridex)", "value": "ee265b039785fdcf4a25bc02cf2f89e0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212983, "uuid": "09e01a68-d955-45c5-a186-761ccfeecee1", "comment": "Malware payload (Dridex)", "value": "955b499162071fa9b1944bdedf8dc21fbb726a25185bdeff587149297cb30ca5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212983, "uuid": "a46a1dc1-e30b-4e36-8223-da7f9034ac05", "comment": "Malware payload (Dridex)", "value": "f9285549bcf75fb589a55721c3d173917fce752d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212983, "uuid": "a5612bf2-18a3-4946-87f8-62460602876b", "comment": "Malware payload (Dridex)", "value": "7e3ca43245a5f175d2d070e152e97bb865d9cea297e203a66c690e22008ea6d36f08519ef949207a0171f916585c9616", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212983, "uuid": "0f8c5cc6-2466-4f95-90a3-f2cb9c818350", "value": "T1BAB5D010EE69E1E6C6B89F3ED408352727F93D75110D608CC392608F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212983, "uuid": "c126b4d3-c27a-47ca-b0ba-8f28ada7720e", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212983, "uuid": "a2fbd4c3-c978-4c5b-a973-5a6c5c7b6432", "value": "12288:4VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:tfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632212983, "uuid": "d9a6ee9c-aae8-4c5d-b124-774390004d6f", "value": 2322432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632212983, "uuid": "df955021-e9cb-43dc-981e-6597f49ecad4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212983, "uuid": "2c2bb164-7537-4cac-aa93-8eabd6356b81", "value": "955b499162071fa9b1944bdedf8dc21fbb726a25185bdeff587149297cb30ca5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d19a5e6-1aa4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632205431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632205431, "uuid": "7dd90ab7-792a-43fb-95d3-b9f15697770e", "comment": "Malware payload (AgentTesla)", "value": "4b40277e5c2047bec8a6764fb670dc56", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632205431, "uuid": "63bc9fc1-99e8-4e01-88cd-5c693ae9dd58", "comment": "Malware payload (AgentTesla)", "value": "964b7ee1eed450e550d268befc3bc6fb83feb396d124112d75ee23013fb4b7d9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632205431, "uuid": "200d76bf-a9d7-444f-a067-ac781519ff6f", "comment": "Malware payload (AgentTesla)", "value": "dbe391dba4c0933b288fba4bd1a5cd08d8ef186e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632205431, "uuid": "aba2ff7f-c93f-4ac3-9432-be293891430f", "comment": "Malware payload (AgentTesla)", "value": "a5971f4fcb13e6c44523dc76516017b4c18abb7cb0336e9b14bfd0313c71206b4edead3073b2daeb1a5acf980234ead1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632205431, "uuid": "89c83451-8047-418a-9a79-c3ef16c81379", "value": "T1E9C1E806B3D8832BECB70B392C7353419278BF60D963DF2D3AD8411EAE167059922B71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632205431, "uuid": "cedcca1f-4ad0-4b6c-83dc-ec0383cd5aaa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632205431, "uuid": "76c45e58-61d8-4ac3-aa37-ea414473780a", "value": "48:6xECJZJoN+pN5i0NBl+sajduJudnjP6jZ1mXVw2b/NWgvgHKoFXJlVO32WMsKOvO:m8N+z5XkvjP6jZ1+w2b9gH9F9VWzNt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632205431, "uuid": "7ef55c99-9168-4656-84c4-c6abf248851f", "value": 6144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632205431, "uuid": "aac6dab4-acaf-46bf-96dd-f056b5abcfad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632205431, "uuid": "356aa489-b823-422f-b6f1-899f879d921c", "value": "cotizaci\u00f3n.XLXs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fce638d8-1a81-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632190613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632190613, "uuid": "f5116795-d111-4269-895b-9d3a53609a9e", "comment": "Malware payload (AgentTesla)", "value": "bcb95db3c16a2edc2ff3ae285fce9f35", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632190613, "uuid": "73d73836-55de-4138-8c18-7a82afce555f", "comment": "Malware payload (AgentTesla)", "value": "97734c31a55c615106e928e9eb914926e3bc420903311c1431de3e2b4abb2759", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632190613, "uuid": "4e356ffc-a667-4632-b642-03bae163a792", "comment": "Malware payload (AgentTesla)", "value": "d031c48cbd374549f249944d0d15d72c7f8434fe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632190613, "uuid": "efbaef9e-c0f7-493f-9bfb-5c678a64ba83", "comment": "Malware payload (AgentTesla)", "value": "d01880652de7e0da34862ec9fafac384320360f53108ec169c83d8cb64e1edc8850887f5b0a817c99e69faf5cec50a2b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632190613, "uuid": "ba84ccd4-7c2d-49c6-9e22-a1bdc8c34593", "value": "T15A53E0417758BC20E4301FB258BAF3C243B3D74DE4534B5E799E583AAE61A8D0760BE5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632190613, "uuid": "a96f9786-c1d7-4cd0-9c7b-84346191f18f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632190613, "uuid": "aff4c524-2a14-48f6-850e-8809ea600878", "value": "1536:2J0Cy74CT3TrYz6vDpMQ43+41xPNfad5:2J0h0CTXYmvFMQ4b1Lf8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632190613, "uuid": "9c496a72-2b96-45b3-b0c4-2cc518239c7b", "value": 65536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632190613, "uuid": "f0980dd6-785b-4d37-a746-fad69f3b26c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632190613, "uuid": "51b379af-1848-4457-a408-9827bf2ff731", "value": "Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d85d92c7-1b10-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1632251970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632251970, "uuid": "9d7e0158-ed2d-4e55-be8c-47fb906b1445", "comment": "Malware payload (RemcosRAT)", "value": "6e68fa5730e095f6670592b36d95b016", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632251970, "uuid": "ad8c29ee-1db1-4e84-ad32-4e3c2667ed49", "comment": "Malware payload (RemcosRAT)", "value": "97ae37b23106f2d0c1b6d5a23e0a35493658a5e8c8bdbb3fd4e82ce883db67b1", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632251970, "uuid": "719d6583-7c3d-43b9-a23d-d0ce5ecbfc27", "comment": "Malware payload (RemcosRAT)", "value": "3f35149d3d6a145719f280372b3e23e61eef3bc3", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632251970, "uuid": "e3d6822c-e1a2-4d3f-9e62-f9b135d698b9", "comment": "Malware payload (RemcosRAT)", "value": "c71cdbbde9c87742a7c94c941384f1857a22d1ea27a966293ee43e1fd8824024a576323b22e4d87ebe6a91ff38754aa8", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632251970, "uuid": "d1699309-9379-43fc-b4c3-bae0d1ae4ddb", "value": "T1A2D251A3B2D6D809D999037A48E6C6E62727FC516F93938B3245F70E1F71AC08A03657", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632251970, "uuid": "8d985274-ea92-4062-ba05-3d43dffc109e", "value": "768:umk3hOdsylKlgxopeiBNhZFGzE+cL2kdAJW9LQNs+1b+oNm:Dk3hOdsylKlgxopeiBNhZFGzE+cL2kdG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632251970, "uuid": "98ac8f05-92f0-44c6-ad5a-31f0fc39133a", "value": 29184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632251970, "uuid": "b13d6587-5246-4ed7-83a2-df6bcd7a1228", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632251970, "uuid": "d8c15fee-ee37-4923-9929-844145fc8be5", "value": "ACH Payment Remittance.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b819468-1ad0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632224139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632224139, "uuid": "e11e5c38-c654-4a56-ba95-557c02ed06a7", "comment": "Malware payload (RaccoonStealer)", "value": "9ae6bfe3ca9ee5db6161761f74561eaa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632224139, "uuid": "2a5a2c56-8cb6-484b-87b9-837136ae20ff", "comment": "Malware payload (RaccoonStealer)", "value": "97c45c628bfc648cbde5dec7a4386c3222434516caedad7e34272188156dd879", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632224139, "uuid": "f4a92e6f-37d3-4cef-a58e-8648b29454c8", "comment": "Malware payload (RaccoonStealer)", "value": "1c1a8bd0e84231311a914cf351549278009cda7a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632224139, "uuid": "f9bc0377-41b4-46da-aba0-4b5c0d8032cc", "comment": "Malware payload (RaccoonStealer)", "value": "83cfda48c5532b3474e69a4666abdc7736356207d5b1fe77ec52c6080f4153c7b112a072e562cae78281c670b11049ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632224139, "uuid": "762dfe93-319b-4399-98a3-4be86f367bdc", "value": "T19EB4021237D1CE33D58369314B67EBB0A52AB8651D2093873B862A6EEF312D07727357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632224139, "uuid": "706c26dc-49dd-44a9-8e4c-c425e63d8ebe", "value": "019bced73b51911db702af2d47c34cb7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632224139, "uuid": "59c61863-96be-4cbd-836a-8c5fbfe30289", "value": "12288:c2ZeCu0eIRZ75REC5L65/Mc0pSQBGEwgp/AHBai:XeC7eIPEMe/HiGR3Hh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632224139, "uuid": "8bb17724-eb54-4ef7-85b4-e43ee18349ea", "value": 497152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632224139, "uuid": "dc1ca9c5-6ab6-4a43-a656-3a26452e9787", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632224139, "uuid": "c7375d7c-5158-4891-b3ff-004966b33f05", "value": "9ae6bfe3ca9ee5db6161761f74561eaa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d026b57e-1b11-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632252386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632252386, "uuid": "8c8fab9f-c0de-4cef-90b3-c5b22ccd9314", "comment": "Malware payload (RedLineStealer)", "value": "7c884f63b2d812d757ce6bb0bb33d15d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632252386, "uuid": "b892e35a-43c6-45a3-b1a7-0d807a07fb87", "comment": "Malware payload (RedLineStealer)", "value": "99f6d5723f93ac9689ea1f428b9a090b55f068ecdebcfdff854bef0dbd26db6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632252386, "uuid": "3bff408f-b035-4e50-ae99-2f3c1300a7b1", "comment": "Malware payload (RedLineStealer)", "value": "713b655c76b2d0e4e17d5e3f19d6b01ec21bf81d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632252386, "uuid": "e0437030-9420-4e15-92a7-c3a76c747045", "comment": "Malware payload (RedLineStealer)", "value": "ea499595740e8c330aa3e064c6fccd4baeb46690fc6195ad0f07a17ecdcd102ff4180d41f6ed92f679aea87b8770eaa5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632252386, "uuid": "f8f68b11-abce-403f-940e-583160a9c0d3", "value": "T11CA48D6AAB43C801E12D57F082A34F944D2757943E21C9EB96F6DADC2E793C07C0BE46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632252386, "uuid": "9328275e-d043-43f9-80d6-c549389001a3", "value": "55a99143707a26596b2c60570843c661", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632252386, "uuid": "9521b16b-0e18-4d5e-be86-bf5c649f46fc", "value": "6144:E03PbAMTTfZ5/ekjZiueWuJpKMk79uW6hpSw7hWQKHeC:d3PbAAZ9ZjZ4JpK6xpSwNK+C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632252386, "uuid": "58969260-0871-4b4a-80e0-eaa539901bc9", "value": 467456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632252386, "uuid": "d7ac120e-ddf2-4cdf-806a-16db5b1e1019", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632252386, "uuid": "6d6dcab5-20cf-43a3-b417-2d0ace6496cf", "value": "7c884f63b2d812d757ce6bb0bb33d15d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8016b9b8-1ae1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1632231636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231636, "uuid": "e52486d8-dced-44b1-b526-b07e7f4bf84a", "comment": "Malware payload (DanaBot)", "value": "7585e7c9d46c9d8856d3061b91cf3566", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231636, "uuid": "536818ef-6a10-4253-8993-3bf13cedd333", "comment": "Malware payload (DanaBot)", "value": "9c1060f235f5c568ca7461ead6d60926d416d18451b755efd3ab1465681e9d80", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231636, "uuid": "4a013f01-e530-4090-ba99-cd8dc4806626", "comment": "Malware payload (DanaBot)", "value": "d37b04a495faea1bd5ad4fc14ae39e8d05f806e9", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231636, "uuid": "93638a88-d023-4149-bd31-669f7a5d232a", "comment": "Malware payload (DanaBot)", "value": "ba71223df5257cc4ed976d4f55243af411fa6e7cf64ac05bea71c079286a89683b94a1463be56fad1bbd7fd6f916e071", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231636, "uuid": "2518a61a-c2bd-4b4b-a165-aa7d87066a67", "value": "T16D452310BA51CA71E50703300B29DBA43678B97116B5436767627BBFEF312C0BA6637E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231636, "uuid": "e27b1c28-8efe-40e7-b33c-83c2e2ed3191", "value": "671b36eaed947d2e663f25178077764c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231636, "uuid": "a7226989-6479-4596-b8ad-e3e1da3f32f0", "value": "24576:/taeSy0GisYkLIY6jc4+PeZ54oFEczbn0RpDlK+sHdQqL0Uq2Ch:/MTy0Gis/LIYd24GYZlK+sHdQqQUq2Ch", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632231636, "uuid": "33140a6b-c515-4f18-8385-b981d4fab8eb", "value": 1164288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632231636, "uuid": "22addcdb-19e5-4b92-9245-82c0bb483bc8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231636, "uuid": "c358a314-2422-45e5-91e5-e7c97a8fefaa", "value": "7585e7c9d46c9d8856d3061b91cf3566.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "912ff1ff-1ad3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1632225651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632225651, "uuid": "ea4953eb-c338-477b-8f83-defbd8cbc123", "comment": "Malware payload (njrat)", "value": "a85cab873032f76a3d5b8c686d60d14d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632225651, "uuid": "d5907bfa-509b-4a78-8300-4fbe716ed86c", "comment": "Malware payload (njrat)", "value": "9c241da391f641a5c4fabc87d324a8d2eab9cc9eced7368db9af5d946df811aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632225651, "uuid": "687a0287-bf42-4f6d-b4f7-eb1e608e0062", "comment": "Malware payload (njrat)", "value": "23b5d5f953529e5a2d5462e49c741a09a613faa9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632225651, "uuid": "b53b34ce-aa37-4523-80f1-c506f0d355f5", "comment": "Malware payload (njrat)", "value": "a7f93fdd5c7358e128be701b2d4adf939ea48f12a940325c2b277ae1c2aa9a4f4a6a22d675bf687e659b7e49c7ac167b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632225651, "uuid": "6b77fd92-c127-4c1a-91f5-ce990e462b8d", "value": "T10AE318117286EB13CD2E653A0C56199833F7DBC72A53DA4B3FCDE6B9495378B4B04222", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632225651, "uuid": "04f73c01-9680-4fb6-a8f9-c230becc122c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632225651, "uuid": "70a3bbda-5c11-4012-b006-25352a4febe5", "value": "3072:ddsbRjH0ScSqHXH9Ze1AsN39esZzHkDC:/sljH0ScSqHX3bsN39esZi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632225651, "uuid": "cc9b703b-0e0b-4942-b4c9-0af3a4f2d3ee", "value": 156672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632225651, "uuid": "8ae70662-2615-413f-a426-c70f80bc18f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632225651, "uuid": "dc606293-f39d-41d3-99f2-c03899874647", "value": "Presupuesto SEPT 21.pif.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "977c78ef-1ab5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632212777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212777, "uuid": "fbc32e03-ea4d-4fbd-af25-3410ea192211", "comment": "Malware payload (Dridex)", "value": "8e6d42adcd1b6fa56e3e890c671c6081", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212777, "uuid": "c02819c6-d629-4fe2-a624-5c66b0dd9193", "comment": "Malware payload (Dridex)", "value": "9d34e72cf788cdcd82728dc00f7476ee1527d4d909e5b8a72d1666a4de1f7e3d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212777, "uuid": "6bac9d78-c552-49dc-98ca-4bcf9d11c6be", "comment": "Malware payload (Dridex)", "value": "ba362d05f02c4b85961cfc7036a9fc02c2e3eb7e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212777, "uuid": "c77bb787-c6a9-4020-a44d-c01741c47708", "comment": "Malware payload (Dridex)", "value": "20de5f2dbc3cd1632a24aaa80d78be04b3173bc665aec2abd239a0f594bc26ea7d13b3c08f096693bfdf7426d1998ee9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212777, "uuid": "90a755cb-a308-46b7-9eb9-a2dcf019d77e", "value": "T1F406D020EE69E1E6C6B89F3E9418352317F93D75110D608CC392608F5EFC6546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212777, "uuid": "aea0a5e5-6603-4f4c-8246-f5a5bf15881a", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212777, "uuid": "ec7444e5-a504-4167-b651-f3d894d92f26", "value": "12288:AVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ16b4:lfP7fWsK5z9A+WGAW+V5SB6Ct4bnbX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632212777, "uuid": "fcdde45a-e6b8-4fef-b28a-79ebe06f554a", "value": 3964928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632212777, "uuid": "b6a73fad-18c4-423f-949a-4c5c2e8a7e1f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212777, "uuid": "0e19d6f6-830c-4288-a6fe-b6b951342371", "value": "9d34e72cf788cdcd82728dc00f7476ee1527d4d909e5b8a72d1666a4de1f7e3d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6917f289-1ab1-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632210981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632210981, "uuid": "eabc5fd0-411e-4b0b-b968-e26d370586ac", "comment": "Malware payload", "value": "3be465c74620c04b42893eff7c94c6e2", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632210981, "uuid": "8d056354-c57e-47cf-b240-490d2ca957e9", "comment": "Malware payload", "value": "9e259d67e429dcfa1886546b5167e9ed0883ef3282081c3dd5279a89b7b6311e", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632210981, "uuid": "29d20524-6a52-44ce-8673-addbc1241397", "comment": "Malware payload", "value": "92a491e5c7fde3208a49b6a8b580e00aec828508", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632210981, "uuid": "e54f1ff7-a003-4d46-8b08-b40f1cbf267a", "comment": "Malware payload", "value": "b3e5dfa5fb5512aa09d7207a795984070cc58173e463ac1c70c56d848bcad55df20071c7f9c058d4f23e45a5fcaf791c", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632210981, "uuid": "82d57199-59d3-4923-8f7a-29b4ce868cc4", "value": "T114566D16B384913FE0A71A3A496BE694A93F7FA039668C0F5BF4398C4F355407D3624B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632210981, "uuid": "ccec9c34-226c-43bf-8252-6f755d782f87", "value": "98304:L8oEt9zie18XgJvitAtTYD5eT13P+jOOQOefWOYhA:LAJ5phQD5e53P+jOOQy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632210981, "uuid": "983ee52e-4556-4ff4-835c-0bd69018d81d", "value": 6400000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632210981, "uuid": "778c5c02-7e82-4a59-8475-96ee706a8a6d", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632210981, "uuid": "392bf220-2b7a-4664-9a90-467f6a16d9ba", "value": "Correos_Pedido-BY26MD4QTZKY1W3.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8cbd285-1adf-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632230925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632230925, "uuid": "526e2d41-0fb9-4025-a0f0-09b6e8eaa6d1", "comment": "Malware payload", "value": "bf16a9fdd27d42555cc336602f64c171", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632230925, "uuid": "2b307020-7e14-4a56-ba12-9d15f6ace888", "comment": "Malware payload", "value": "9e7d17ebb2aec630aa01fa73762f447df15d785eea2d4288ba36c326a19d7a48", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632230925, "uuid": "6e8cf09e-f609-4e12-98fb-6c7d0c4e30dc", "comment": "Malware payload", "value": "0ce89d8be9dc5a0034c1020720163fc4c351b1a0", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632230925, "uuid": "9d6b1adf-5bf5-4804-815c-ef4eef032303", "comment": "Malware payload", "value": "35eac9b2ef58945cfd6a2dcc59b113b29ac86cf0d9280feff7ac612e6a57885f3ff8daa53d7510368da3815f031fb367", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632230925, "uuid": "a2dbf847-6877-40d7-a0c2-8e2b73a7b1dc", "value": "T16B1523AD93469851FAD75BB0A33D8B5CAAA9C408B1973A2FB0CCE7D5B344708DF24117", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632230925, "uuid": "baf701ac-349c-487c-aec3-57f2d6ea2dfe", "value": "24576:5EN+7NIUDJdVNKDOn0+E5MCmDS01/8P0Q6ZYZSiF757ql7:5E2Ik7NKSno5LJhP0QjZ1z+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632230925, "uuid": "0226a661-a219-4bde-883f-406b6e33d237", "value": 925504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632230925, "uuid": "ee65f7df-263d-4cf2-a848-f822e9a35a82", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632230925, "uuid": "a9ee01be-006b-4138-bbf6-ed442cc359c9", "value": "9e7d17ebb2aec630aa01fa73762f447df15d785eea2d4288ba36c326a19d7a48", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbeb450c-1b11-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632252405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632252405, "uuid": "1e08ec58-12ea-4e92-a466-70e2141a00d4", "comment": "Malware payload (RedLineStealer)", "value": "249de4aff4eb8fc256becd40ef4d67c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632252405, "uuid": "7f4dcb33-5b0b-4246-826e-54615bc402f2", "comment": "Malware payload (RedLineStealer)", "value": "9fd2dbfb299190390df123585a1173313973c7ad0ed52cbc28fab95280f816c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632252405, "uuid": "da0b31e7-27b7-4354-811f-fa4c7b9daf41", "comment": "Malware payload (RedLineStealer)", "value": "107ddb17ae0aadb246d0d486de708775a12f3b25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632252405, "uuid": "0c2ff610-3e5f-43ec-b1b9-2e22af7261e6", "comment": "Malware payload (RedLineStealer)", "value": "5e2b945e459d975b7ad167b9877f67b5feff8fc8360e9fd0be50f200c2569a38a3363d06c183564133fc324f7fd249c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632252405, "uuid": "72a7ee51-d690-405f-a9a5-4c468a8c6933", "value": "T18364E0007EA0CF32D593D9714B21D7E0EA3BB9625960835B376A762EEF312C1766D206", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632252405, "uuid": "acde88b3-b38d-4155-bca8-a1f8c80a67fa", "value": "b4a5f131bf57e0871ab3cda52113b279", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632252405, "uuid": "aca0beb7-aca1-4a07-afbb-0eefcf527c53", "value": "6144:ryjFK+waM+tYd5iTIj0kWECpZMtTiATKfnSTiDcBwjtw:GjFwkQg8jBWB22AICiDcBai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632252405, "uuid": "61214bfa-3284-423c-871e-abba2ac36aea", "value": 311296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632252405, "uuid": "6be226d1-ffff-4604-9f28-069e98264905", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632252405, "uuid": "8159e7e3-d53f-4061-9d2a-16d5e181dbf8", "value": "249de4aff4eb8fc256becd40ef4d67c1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "151e7f87-1ab7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Stop)", "timestamp": 1632213417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213417, "uuid": "7365cd19-2c23-443f-ae8a-57732f769040", "comment": "Malware payload (Stop)", "value": "bbd7e53b129ceed43bc318c91140cb1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213417, "uuid": "9899ce36-624b-4030-bff4-aed62e9ca725", "comment": "Malware payload (Stop)", "value": "a15f72a2d96072229513aa1cf5d8b8747282b5edcb3781a16cba7f1511ddaebb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213417, "uuid": "ef2b341d-6cdf-4bd7-8f8b-bd947cc90643", "comment": "Malware payload (Stop)", "value": "0560c590daa3a599e87bf7b1c3dcd1472956f19c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213417, "uuid": "28c7738a-171a-4a19-b708-8a186565d3e3", "comment": "Malware payload (Stop)", "value": "05b0bd083f7e7d850066f838e251330c4c984d71290c506603a97bff2eb577abbc70c3c82fcbd66a989e44794a937d41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213417, "uuid": "30b26b87-39ba-490e-99c3-5eca59338bb3", "value": "T1E6F40131B2A1C034E5B752F418B993A8A53DBDB16B7451CB62C616EE2738AF4DC30793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213417, "uuid": "7e32482c-6cc8-4fcd-a75c-8147c47459cc", "value": "9b494192bab1e0e5f914d8f6d610f95a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213417, "uuid": "b7153412-8452-4886-b4af-be7e7b9b7073", "value": "12288:2ZK/PCUKwr+1hykJ21JD+KY64NJB+1T0CLIvOWZ6fP0a9IvF5t7TagtWt/+XS:28/PCl+Y21JDXY6qn+1IoIvO4R4IvB7T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632213417, "uuid": "87b9b77c-a901-4078-9ae2-bc8b464d13b1", "value": 781312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632213417, "uuid": "ba267ac1-24a3-41e5-811b-06cc8b6166b2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213417, "uuid": "3dbf8f3e-be7d-4875-b4e3-4e3b701e22f4", "value": "a15f72a2d96072229513aa1cf5d8b8747282b5edcb3781a16cba7f1511ddaebb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09c923af-1aa7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632206526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632206526, "uuid": "2c66c196-7822-4e87-b83e-2436f1527f5c", "comment": "Malware payload (Dridex)", "value": "86ce09d8758a61db05aa099de62b1935", "object_relation": "md5", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632206526, "uuid": "57210d62-8065-49b4-80f9-67f7a22a445c", "comment": "Malware payload (Dridex)", "value": "a1d46848e19575fb1226f0f5207b9f319db0a092dc742cc2d8a2408de963be2a", "object_relation": "sha256", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632206526, "uuid": "868875eb-63a5-4992-a360-ca685ebe66c9", "comment": "Malware payload (Dridex)", "value": "faa187c15ae5e3070c09bea09df7e07f3600cbeb", "object_relation": "sha1", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632206526, "uuid": "44c9e596-dd49-49e5-b7a3-bfa31e6b02f4", "comment": "Malware payload (Dridex)", "value": "715cfb18f043078f578813ae10a35500482cc73d63bbe07d9063e30ba7155ea10038d4f6864f9d57dcb806206b25bd37", "object_relation": "sha3-384", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632206526, "uuid": "9ec834d1-2bd7-4aac-8c07-08bce6e0e869", "value": "T14814E07ABFFBE0F6C82E82F3417582751859D8349718CA77C6B3F929D4750D462A8C22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632206526, "uuid": "1a3909b5-6d12-40f2-b561-da8d7479351f", "value": "f8e5a95d062791486e95dac858f22b5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632206526, "uuid": "726de596-16c8-41c8-90a5-2330892b044f", "value": "3072:l9g3Pf+EEZ8x1ap5V5VSwI347BCbWKep1oAfxkOudNCesGC:l9g3PfK8xmgLaBCbWXNkOE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632206526, "uuid": "539b501b-c37b-4361-a522-a5d5d1c96bec", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632206526, "uuid": "34340231-dae7-4f44-b5f6-7e66ff5134b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632206526, "uuid": "b6b9082f-7a3e-4343-83c3-4065b9af818f", "value": "86ce09d8758a61db05aa099de62b1935.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4d0da21-1ab1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632211162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632211162, "uuid": "510eb8ad-e572-4905-80d1-e9bbd8de3e5b", "comment": "Malware payload (AgentTesla)", "value": "a6af2d85ef9157710dd3cd2a1ccb4a6f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632211162, "uuid": "8054eecf-44b3-458e-8b7a-2dc6441c877f", "comment": "Malware payload (AgentTesla)", "value": "a3184dc5ee0ed90bd869704e30abba43a30795334b2ff449df567b0df139e0f3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632211162, "uuid": "51651284-3da1-4371-8199-daa8b033cac1", "comment": "Malware payload (AgentTesla)", "value": "ccb6e75bbfcaf0541124d64681fb77a4397d8c6a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632211162, "uuid": "17b446ef-ad8a-4556-ab44-1c2acb72e8d2", "comment": "Malware payload (AgentTesla)", "value": "33bfad17eab2156becbdadfc989ea4fc5f5cfc8ebd03d4125d1206775832945abdedef33cd8c15ebd58537a851550a33", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632211162, "uuid": "724173ae-0136-4d26-9de0-a924031fa312", "value": "T178C1D706B3D8832BECBB0B392C7353419178BF11D973EF2D3AD8411EAE567449922B61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632211162, "uuid": "c8bd853c-a470-4e60-a31c-9d61a5e0e237", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632211162, "uuid": "efdfc069-bd32-4cc7-9230-6a21591f57ec", "value": "96:C8N+z5XkzjP6jZ1+w2b78mgWJ9F1VyzNt:fyZwZ9FX0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632211162, "uuid": "fab5d768-00f6-4761-90fd-55cd91ba2dbb", "value": 6144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632211162, "uuid": "ccf8e5de-ae66-40ba-a356-c6dbe4d90f95", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632211162, "uuid": "36495e4e-a3c6-4222-8724-93f80c0b4462", "value": "cotizaci\u00f3n.PDF______________________________________.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff6f340a-1ab1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1632211233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632211233, "uuid": "b59f45c6-a2a9-4621-9da3-10dd2689e861", "comment": "Malware payload (RemcosRAT)", "value": "3bbc40e1ec9123bf7b0f827845f0e4a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FRA", "colour": "#FC6B68", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632211233, "uuid": "aad61e83-ae85-44f9-ab64-d9816ea20594", "comment": "Malware payload (RemcosRAT)", "value": "a3aab02445dfa2ff67c27a8965fb2263965c2ad3f31475e6b6a4459b5c191827", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FRA", "colour": "#FC6B68", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632211233, "uuid": "91c20d6e-62e9-41e7-b4eb-a865c29fb02c", "comment": "Malware payload (RemcosRAT)", "value": "d7530f423e518d980c61a21e8083f2b30d55f0d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FRA", "colour": "#FC6B68", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632211233, "uuid": "2b3282df-250a-48ee-aa5d-0a400186b0f5", "comment": "Malware payload (RemcosRAT)", "value": "c1d8e6669beeded5ece0a729dbb9ece6687791718927b6813191aedb40b39a58299ffcadbd64f5781c778279c8e8da1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FRA", "colour": "#FC6B68", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632211233, "uuid": "2a276921-baac-4042-ac00-c5d1da2b4649", "value": "T1FD356BE373C0DCA1ED24393ECD4671616A287FF839029C4DBD647B8A3A65A64F89C447", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632211233, "uuid": "08be5393-398b-426d-a25e-eb3a3c6deaaf", "value": "bc8cc1eea5c25ce2056d7da92bd98134", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632211233, "uuid": "1f3e98f7-3697-4124-bdec-ee8a11784fc2", "value": "12288:BSZPsJUL/MN/cen/VwTQBXcameDCnNmBeoAdrL7+o:bOQN/cu/VdBXKyCnEwrP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632211233, "uuid": "1eb3bbd8-f0c6-4393-abb3-1fcc782b5bbd", "value": 1080320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632211233, "uuid": "4a455fd9-588b-48fb-ac51-44546006f382", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632211233, "uuid": "db3573c8-6110-4bab-8b96-930747f4f419", "value": "HP PREMI\u00c8RE COMMANDE-O3131P4,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5d71f25-1b11-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632252395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632252395, "uuid": "72776260-8049-4315-80c2-add9142ada97", "comment": "Malware payload (AgentTesla)", "value": "7cdbe7b759c4273e08ddb3bf15142556", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632252395, "uuid": "139e98d0-de82-4804-99d3-1075d8119f04", "comment": "Malware payload (AgentTesla)", "value": "a5ccb1863a186b32287b8cd061207ff95d8c34f7ff8d1749846f35188c15ab0d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632252395, "uuid": "5946ea9b-7bb7-4cc6-8ed0-1e6ec0e09877", "comment": "Malware payload (AgentTesla)", "value": "ac9819a486b12bb683fb02f70244f2640e6c1a7d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632252395, "uuid": "558bc4f2-a497-49ab-9a45-32f18b5005fa", "comment": "Malware payload (AgentTesla)", "value": "109559ac29e77b71fb6cfe2380bd458a065bc62782f903afccadccccfedf8cd312d42da80472d2c450bedcbf6392ed98", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632252395, "uuid": "ded3fa6f-96d7-48dd-b732-d6c1a8b8ca97", "value": "T191157CC2D2514680FC3E1B7415341E4417B67FEAAE7EA62D44B170952EB32C3AE1BE4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632252395, "uuid": "73e384a7-cb5f-4a37-890b-7af06e0631ce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632252395, "uuid": "ef14c238-85c8-4f84-9a3f-364463bb74f8", "value": "12288:/JgJB2/xfZP7t4/GYVzC85qix1rkWEgxh0WhMO1GnnTyLC6qnkutwZqa66bWPcnG:mix9W/rzCsx1T0eZM6C6qHigc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632252395, "uuid": "383720f4-cf9d-49b7-8067-74dea2d9161f", "value": 946688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632252395, "uuid": "87cfe668-5c91-4619-91df-cd72388a155e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632252395, "uuid": "8b56eea0-ac88-47ba-ba70-01391f0845d7", "value": "7cdbe7b759c4273e08ddb3bf15142556.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "218ddfb9-1ab7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NetWire)", "timestamp": 1632213438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213438, "uuid": "e13d999d-fd6a-4478-8c1b-a279aa256ca2", "comment": "Malware payload (NetWire)", "value": "0a6a25cfacfd3b719895d74ce7e4df3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213438, "uuid": "3eb78703-26fb-4d1e-ba4d-332f72e03407", "comment": "Malware payload (NetWire)", "value": "a664d6a9ca31c3769df8098758e284ee9f5771c65fc9cbe223867ac979c2787a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213438, "uuid": "ff3d0dfc-ec3a-4202-a56d-bc2488b616b2", "comment": "Malware payload (NetWire)", "value": "d99fa9ca1b1c859bb0d96e33b716f09fecc67c50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213438, "uuid": "6d905e58-179a-47ca-8dee-16a5ce5f8816", "comment": "Malware payload (NetWire)", "value": "915b1e446f50cfcb2b0dc93394f3a33263a17b4a2f0dc2a08ac614b7ee4e951f74c8cc2c130e5e2ac1ca8d50aa776650", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213438, "uuid": "175cba85-5cc9-40ef-b1ce-78c8059a61cd", "value": "T19205DF4CF285EA55D916463288B7D8910233BC1AFD62DB8F31C9737B19737D2291B84B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213438, "uuid": "879892c5-0776-47bd-96ba-54d6721c84f5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213438, "uuid": "82ce3b53-454e-4468-8adb-0c201570e63c", "value": "6144:maP5uW22/dKAqKHeq9yWNVrHrGPVvosA0GZ8jeyPPtZBnxp74:xhD2SqKHqWNJCk0GZEegj4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632213438, "uuid": "ee594b60-4bda-4117-899b-6a44197dbdd3", "value": 850912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632213438, "uuid": "edeedb27-619a-4ceb-b6f7-7998d24b0ddb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213438, "uuid": "50c430b8-e49c-47da-9be0-a0edafdf182f", "value": "a664d6a9ca31c3769df8098758e284ee9f5771c65fc9cbe223867ac979c2787a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "824eb819-1ab5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1632212741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212741, "uuid": "27dd576c-17de-486f-b70e-302084a7d7fd", "comment": "Malware payload (AveMariaRAT)", "value": "e9fc9665b115a8e3086ffdccedf55ff2", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212741, "uuid": "90c25dbf-f96e-4cc8-8b9e-77ca0ff14687", "comment": "Malware payload (AveMariaRAT)", "value": "a7a21dfa8e651c8d878332c20e2d42e20247b98f46c2e4f7b15d972325d1dfc8", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212741, "uuid": "162339fa-0833-420f-945c-cdcc357b6ffc", "comment": "Malware payload (AveMariaRAT)", "value": "2726d1f84de185b4562c1148cbdfe17cd5224883", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212741, "uuid": "47bbd05d-d55a-465c-83ea-b26391b1c4a8", "comment": "Malware payload (AveMariaRAT)", "value": "ad7b4eda028f952222de09fe91d843693ea4e653514660097551d0bd550f62bc45fb4fb91808c6fe895ef1f19d8458eb", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212741, "uuid": "f5cd6d2b-dcc9-444d-8ea4-a126b73ed0ee", "value": "T1D9361260B55DFAB9E40ABBBD14E32607533E9F90EB1EF2E714C0ED57044B62806B3895", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212741, "uuid": "ff40bc7d-f83f-4608-87eb-e6278f9f73e7", "value": "084fafd5fea9d39b4ff35f2d82f0908b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212741, "uuid": "3849b74d-0750-45ab-9129-d798e828a04c", "value": "49152:bmiKc++Ax+qWgENpuqWOl4ptAXw4+NsFeeNqKL/tfMtFX:TE+G+HwXOkWXw4+NsFeeNqKLFktFX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632212741, "uuid": "4c040624-94cc-410d-997d-315de53c7e45", "value": 5154977, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632212741, "uuid": "7c456983-ed32-44e9-afff-bd8c72d77b70", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212741, "uuid": "cb5b6802-2f91-4461-84eb-abddb2d1c0ee", "value": "a7a21dfa8e651c8d878332c20e2d42e20247b98f46c2e4f7b15d972325d1dfc8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a643391-1aad-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632209185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632209185, "uuid": "dfb08481-053e-4969-b05d-edda532b775c", "comment": "Malware payload (AgentTesla)", "value": "19de024852f18e867582c47b9630e7a5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632209185, "uuid": "735e5fc3-0448-4e8a-80e5-42d6415374ac", "comment": "Malware payload (AgentTesla)", "value": "a869d25f620488633db7ca434ec6a1060ffd8a987cd7722afcab835f5cb09f05", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632209185, "uuid": "7c5987e0-edc3-4ff1-b394-809d954872d9", "comment": "Malware payload (AgentTesla)", "value": "a64ee80b6c81f4f6eaab61a27fd5c472bdab7263", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632209185, "uuid": "b509d839-0242-46f9-b348-c20ac69ba65e", "comment": "Malware payload (AgentTesla)", "value": "e22b99a498d88a963a6539283c5b9d33ea4c7e663f1775535f6687493f0e5dd1c65ffce46cabde9bc8576920bdfe1544", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632209185, "uuid": "f3c58aa4-6973-4170-bf99-0493ab4665ef", "value": "T17D15F900DB664F45E0B5F73691A8640D47FAF8C3E752CF6CAB5907C909B3280DA5EB29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632209185, "uuid": "47c6922c-474c-4c30-a976-a03e5aca7cee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632209185, "uuid": "2d4ae0a2-d4ec-4990-9f38-08b3dfd4b0d4", "value": "12288:o/oKv2h+aA0iMIliH6cT/410wzWUOkRCBGRAIYCh:0KrgWz7kZ2IYCh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632209185, "uuid": "f4d176a1-6172-4f54-8976-16d65450e8df", "value": 920064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632209185, "uuid": "e8cb7d36-9874-4a2c-9169-f2e02e40d5cf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632209185, "uuid": "770ba0a3-01f9-457e-b3d2-fbf074585a8c", "value": "19de024852f18e867582c47b9630e7a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a9aa5fd-1ab5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632212782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212782, "uuid": "45025fbe-5646-4d3d-8057-73fb05b96291", "comment": "Malware payload (Dridex)", "value": "b57f4785d90daa56899b9e3e5264d0a3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212782, "uuid": "08971b99-22bf-49db-b2aa-34c8f3a4a196", "comment": "Malware payload (Dridex)", "value": "a88c7e563ecc756cdd9c6a739fc56b0b2f6601362911eba5138d73ffaaccfc0d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212782, "uuid": "3d628240-b45b-420e-b07a-f3b76ddd82fe", "comment": "Malware payload (Dridex)", "value": "6e362a4cac3c5a13ffa9c40dc6954f9d8d2d9ca1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212782, "uuid": "8ad25191-90f1-4f60-a493-f1339254fc61", "comment": "Malware payload (Dridex)", "value": "f76f3189d3d77c871f23bc4d9714296759c82e6af088fd2095b11fab56a079ce28b54ed833e5310831e7bd4e5f41db92", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212782, "uuid": "6eae2a90-b260-490c-aead-7266adf33819", "value": "T15B06D010EF69E1E6C6B89F3E9408352727B93D75110D608CC392608F5EFC6546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212782, "uuid": "618afc9b-cc88-4919-b8e4-cd13348c0fb3", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212782, "uuid": "d73cb2a3-a6f5-45c3-b47e-33fd3e43d546", "value": "12288:EVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:hfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632212782, "uuid": "a9a3127a-1351-4d7d-bec3-6ae76493e9ea", "value": 3731456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632212782, "uuid": "299f03ef-2bec-4edb-87f8-52f3308aeab0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212782, "uuid": "1046452b-c88c-46cd-89b2-997dd22c5507", "value": "a88c7e563ecc756cdd9c6a739fc56b0b2f6601362911eba5138d73ffaaccfc0d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad381051-1b10-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1632251898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632251898, "uuid": "39e8dee7-015b-4cfc-8a71-8a37aea5f512", "comment": "Malware payload (njrat)", "value": "78f682ff5ec94db41c3dcfc558a7027d", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632251898, "uuid": "79769213-88d3-4164-86ad-343289991ec0", "comment": "Malware payload (njrat)", "value": "a996ff95783d0e2bc97c3e95539de831788725c7b97514ff88041f041c6172c9", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632251898, "uuid": "6286b22d-587d-423b-879b-7cde8cb0482c", "comment": "Malware payload (njrat)", "value": "1cb46725c52f87119146b6e12092779827e42c29", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632251898, "uuid": "27d655a0-959d-45d7-ae84-cc035e615699", "comment": "Malware payload (njrat)", "value": "c1f16caeb440ab6119bc4713d00d4f63d7ae761d99be834bb51cef0e4fcb36e46357b1a6d27945062564158a383a096d", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632251898, "uuid": "ecae23a8-bdda-4dc6-9b82-248ef7116edd", "value": "T1A5F12F3CE60376DD741D5E2D09CB77295A10C0B5C953E6F9C740FAAC69EEB40AB51238", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632251898, "uuid": "3a6a573e-1098-48af-8d45-a2913cb13bab", "value": "96:P7NTJhS9INIKMVGQRX8+HLz9spiINIVIWjnCQRX8Lnaa:P7NT2INIRRX8+Hm4INIVI8xRXAx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632251898, "uuid": "738b2419-3af0-47f0-8bd4-7df8bf5155a5", "value": 7753, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632251898, "uuid": "d2960bbc-9c6b-488f-adb3-39e330b27216", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632251898, "uuid": "dcb0b3d5-c94c-43a8-af0f-f4ce38d3a81e", "value": "Quotation.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c29b205-1ab7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NetWire)", "timestamp": 1632213402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213402, "uuid": "e8304da3-4a3c-423a-87ff-0a8bc79b62cf", "comment": "Malware payload (NetWire)", "value": "205519e07ea99c49da0872313c858237", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213402, "uuid": "2ee1acee-8197-487d-a717-028681d277f2", "comment": "Malware payload (NetWire)", "value": "aaec7d28795c24dce237cc3ae412681507d0454474d49f7b077ca3013789e3bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213402, "uuid": "f78542f0-e942-4efe-a968-7a3c34b7646b", "comment": "Malware payload (NetWire)", "value": "b0f4b1d430eb2fa41a33d1ba5a757d4f052cc624", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213402, "uuid": "8037b352-6584-4f63-89ae-fe8ff8f3c5cb", "comment": "Malware payload (NetWire)", "value": "f42f5b0e4b874c3128a1117f7cf7b60527cb2934c61bd890226181521e8e1bb6eac7f0a2a6b866e8b3d47a67131ec134", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213402, "uuid": "5be3af1a-e89a-423a-9ee7-27b82b237671", "value": "T1E8E42391F7EDA595F4F78A73443D8C3049B67C9EACB8C20C12A4395D9C733914869F2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213402, "uuid": "df420683-e33a-430d-b396-7b96ff4ed4e1", "value": "fc6683d30d9f25244a50fd5357825e79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213402, "uuid": "3167a072-b017-4108-a34c-e6dcb5002bce", "value": "12288:uquErHF6xC9D6DmR1J98w4oknqOKwQAYBrt1F4Uy2Rmqb5BNrU5jNSHZaCz:jrl6kD68JmloO6B58NqmqbH5UfS0Cz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632213402, "uuid": "b56e3df8-cb7d-41ca-900d-3f8bded7c0bf", "value": 699160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632213402, "uuid": "77db7764-0d7b-493b-ae48-4da565cdf394", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213402, "uuid": "f9fe768c-1ef3-43c3-b97e-a8a8ce0acd66", "value": "aaec7d28795c24dce237cc3ae412681507d0454474d49f7b077ca3013789e3bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47f5f6c7-1a71-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632183438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632183438, "uuid": "24db74f2-12d4-4bd3-8b27-e23e24d8b38b", "comment": "Malware payload (Formbook)", "value": "08098c5ef23fb87af19a5adbdd31324b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632183438, "uuid": "94723f88-17e1-44fa-bf9f-6554a9099f4f", "comment": "Malware payload (Formbook)", "value": "ab4676fc90e455da2127126bfbd1fd167328c79eda83f686ef71dd89266825f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632183438, "uuid": "32b49990-03f4-47b3-b134-7dd01450d7df", "comment": "Malware payload (Formbook)", "value": "19645fc145feaa325c5cc765bc873075a0aa7512", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632183438, "uuid": "346225ee-c781-4e6f-a076-92539615bd16", "comment": "Malware payload (Formbook)", "value": "92b3136ad303c034ffdf95b2b9418e7158a5c85784a4fc7239306c748e9be136a10192dca72ba94bb11bae5f333dce36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632183438, "uuid": "9df69b15-3a6a-4929-a9b8-50ceb9891f1e", "value": "T15D05ADC27D47D89BF0DF2AB398AFC42011656E8D9161C73D36867A2B54F3352306BA4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632183438, "uuid": "191b0552-1c0d-465b-aece-2a6dbea23437", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632183438, "uuid": "ac113cee-7d76-4a16-af0b-2b063aebc782", "value": "12288:G+vLaFsmtiK5oUZ3Wj+RellamFY42oDSYlIqxRmiBlGQK:Oa+Fo/hFY4JX5RZlZK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632183438, "uuid": "fd179199-e989-49b3-a92b-4b60c864ec6a", "value": 833024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632183438, "uuid": "67a3ab66-b5ac-4f15-93e9-3e3107552c52", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632183438, "uuid": "e816c9d1-5ae1-4a09-9f2e-ee4c3afac4d3", "value": "Updated SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df72ac99-1ab6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1632213327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213327, "uuid": "afc235ed-2f9e-43fe-8ce2-6d182c07500a", "comment": "Malware payload (AsyncRAT)", "value": "d5a97ee20fedd500016eb01a4705bdea", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213327, "uuid": "6fa4898d-dd75-4144-b274-507c1a503779", "comment": "Malware payload (AsyncRAT)", "value": "abf50dc501940ce8aec971d88fcf9252a943589f5d44287556e692930c0451dd", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213327, "uuid": "c23c139a-3324-4dfb-a27b-d4b2b6574823", "comment": "Malware payload (AsyncRAT)", "value": "38e022a0ede58cb7bcbc1e0992f12d0a47a0601f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213327, "uuid": "523bd5b8-fff5-4c67-8194-897b2d1e246d", "comment": "Malware payload (AsyncRAT)", "value": "2cdde42b65cc687ec5e5200aaf5a456bdaa77a3a917537079f7b59b3abe5a147dd4968101669a8a0721ffc4f3a985bb1", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213327, "uuid": "5b8b1a47-94b1-46d5-98dd-9321abd011a4", "value": "T17244230072D3CDFBC1B250B14A772761FFB395850232558B9B94EA3B5AB224B5F36682", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213327, "uuid": "57edfa74-5dad-4b5c-a165-03be917607ee", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213327, "uuid": "bce7749c-aecb-4a93-943c-5920f89c60bb", "value": "6144:t8LxBoj/evZJrKCM9UswCRWGYi1hqulZu7pCMy:zjSZKUb3GYwbl02", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632213327, "uuid": "bd1a6619-b134-4660-8d95-59213531afc7", "value": 275539, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632213327, "uuid": "7891e26b-7ade-4e78-a1db-b9f04d0aa07d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213327, "uuid": "5a072be9-ead9-4970-8cac-315a4dd4e5bd", "value": "abf50dc501940ce8aec971d88fcf9252a943589f5d44287556e692930c0451dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5a2dfd2-1aec-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632236504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632236504, "uuid": "ca297485-9f76-4333-99f4-0cac675fa752", "comment": "Malware payload", "value": "e8f8d848581a8dc8689bd58c6952eea8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632236504, "uuid": "cd344057-569c-4769-a066-aed77211e218", "comment": "Malware payload", "value": "ac229436a6a98312c9ae47102a3a804b6be15e5dbf96b141c95efc969f3b98d6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632236504, "uuid": "f16d36a5-8682-4605-a217-dd86fb273f0e", "comment": "Malware payload", "value": "f3f2f6796cd280344f1334f5b63c9025afd41af3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632236504, "uuid": "9dbb6b31-87f8-4d92-9a3c-a62177156a51", "comment": "Malware payload", "value": "4f06a192dc53955296b3d65224777f2b257b6d0979518579ddfd287b198bb937836f13639c4cfcffe0e1c5b25e380411", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632236504, "uuid": "97629a59-b8ac-42e6-b4bf-3cefdf6cbbd3", "value": "T13533026F2672B7C6FD4C487654E95231AE4830A0929FCB3BD3686D48663AC43D15FCB1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632236504, "uuid": "02015e94-d6c8-4488-8e08-67f142601864", "value": "1536:chchlw+MBZAvaCzQJHw3i/YHsK1u3PCw0CCC:jw+oZASnSiQd8ACCC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632236504, "uuid": "641f3343-df1c-4cf7-add7-a4439bda9c49", "value": 51180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632236504, "uuid": "ff0a1da1-e9f8-4d80-8de8-62603304b308", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632236504, "uuid": "73f30938-44e3-44b4-a467-1c9ea8327cf1", "value": "e8f8d848581a8dc8689bd58c6952eea8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee247197-1b11-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632252436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632252436, "uuid": "7095c1e4-1c41-4529-9944-8f966205a8f2", "comment": "Malware payload (RedLineStealer)", "value": "24d0e61364e631d08ad94f8aa2a6606a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632252436, "uuid": "0bbae870-43bd-4be5-ae63-afa0a77b6a6e", "comment": "Malware payload (RedLineStealer)", "value": "ad0048e191fb0db386dfada7927fc139777d8a85858073fd014c0989794b9e73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632252436, "uuid": "47ccfc0f-f3b3-47b1-b489-006499dc9db2", "comment": "Malware payload (RedLineStealer)", "value": "48fa955394f03b9c0a014d4a1dbf079b59deb3d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632252436, "uuid": "406dae00-7462-4cbf-92c3-a827420b806c", "comment": "Malware payload (RedLineStealer)", "value": "e4edbc91242b24a3887d7d7e16c1552685fe922d58719c048d831f1c38774d36f584944b82b0d8f9f6d0b3a5aa27abf9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632252436, "uuid": "c58cd7e9-bd98-4bac-84fa-1383db560843", "value": "T12B64E00176B0CB31CA63A1704B60D7E16E7BB8615A71835337667A7EEF306E07B26316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632252436, "uuid": "feaf56c3-9f76-4894-a624-9f6e0b7bc080", "value": "b4a5f131bf57e0871ab3cda52113b279", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632252436, "uuid": "0e3495a3-f35b-4013-ab67-b162f1fdefb0", "value": "6144:fyTYfTb8kRXbRElh0xXbF5L6Oj3hT54ATyNR0OanOHvBwjtw:KTYH8Q+lhQeO3IAmNRhvBai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632252436, "uuid": "6160da3a-2876-4816-ae3e-643628257d93", "value": 312320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632252436, "uuid": "b3b48d69-9e5c-49ee-b1ea-9f33efae5d6d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632252436, "uuid": "040ce309-07da-40c2-8757-457d65c3d596", "value": "24d0e61364e631d08ad94f8aa2a6606a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ae35497-1aeb-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632235761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632235761, "uuid": "2c4eaa19-0059-4dfb-ab41-4463e59942c0", "comment": "Malware payload", "value": "9d18abc5fe0d0294ba1b0fe870767944", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632235761, "uuid": "057a26d8-aae9-4dd0-a4de-bacafe06506e", "comment": "Malware payload", "value": "aeaacec22b06e684c0d39d9ee1473db04eb6dfa07fe6e11daa76e7a4357080ef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632235761, "uuid": "8517dfeb-8f80-41c0-986b-fa1c7729aa2c", "comment": "Malware payload", "value": "1772710e756416bce128905e295c8c186e857d51", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632235761, "uuid": "23e986e0-78a8-4c0e-9e57-98734bad263c", "comment": "Malware payload", "value": "40cc2f9f7e22714f1b71b02dd434891392321f75efe8e44164a8d8be94e34dfe533bbb6dd98321f15e526e1cf3ad17fc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632235761, "uuid": "39bfc8a3-3f8e-4b60-93c5-7f7c90c0db2a", "value": "T1BB23F11EEAF88EC1FE9331B88C7AB740A7F40B9E72B4A720579F7E164F252154806945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632235761, "uuid": "cf7cc16d-aa98-4d19-8532-5b845b802b64", "value": "768:3mm53tHPR06dfRTxP8SMoJDVIYtx/4WPQ23rq1KQG4AWJZg0I4uVcqgw02NWXyFK:3myn06XTiSMGhrH/4SxQG0JZg0I4u+q+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632235761, "uuid": "513e8d71-8c30-4786-b8ba-dcd138c42959", "value": 45804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632235761, "uuid": "4b6b1843-7f80-4c8e-86ab-ac9fd10b2fe0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632235761, "uuid": "46b647c5-25af-4c53-b1ef-b9d72bf338b2", "value": "9d18abc5fe0d0294ba1b0fe870767944", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aab9009-1b00-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632244860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632244860, "uuid": "24c10077-bacc-4340-94c5-0aba74998bd3", "comment": "Malware payload (Formbook)", "value": "ad3b7a36fc62bf369b5c563d2b5db945", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632244860, "uuid": "11d32e68-c417-49a6-9a5d-1af08375753c", "comment": "Malware payload (Formbook)", "value": "af0af3ebf3ac231ad77dbe4cbfa0fb2d48312d4ca0b5431081046ab09aa3b552", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632244860, "uuid": "6c961d28-d758-44d6-be82-44c3cb3d1803", "comment": "Malware payload (Formbook)", "value": "3e43c14f9e010f1bcdcce6618f9ca5503de08579", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632244860, "uuid": "f5b888f6-c301-4b58-8f52-40f382fb9596", "comment": "Malware payload (Formbook)", "value": "d2e872661c598e989d6a42952bb4b283d3158dc10be5651155186ed8168a6645138c8c060603181b78f27ab8773086ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632244860, "uuid": "ef82c860-60e8-46bb-9c8c-2469f32a3f62", "value": "T105C42339C719D771C85D9BBF102256480BB4A2C6BA23DE25AF87F08DEC1B7C14229DB5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632244860, "uuid": "768dc43a-06ac-40d5-aa1c-dc7781031f6c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632244860, "uuid": "80c85319-b572-4815-acae-a25f97381fb0", "value": "12288:9IdemtiK5oBfZQElcqE+RqFoVnQ1PSYNsEOmuBE6rp:V+FoBfDcqE+4FInqPSzmf6rp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632244860, "uuid": "417a5595-aa95-4f52-8c24-ac6ff54a208e", "value": 549376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632244860, "uuid": "582f4525-099f-42d5-a592-7860deb4e639", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632244860, "uuid": "bff67f0d-c721-43d2-b2c8-249da5456b4e", "value": "Facturas Pagadas.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c384cb08-1ac4-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632219293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632219293, "uuid": "e52c4f13-c50f-44b4-bc2a-aef71a9d09f9", "comment": "Malware payload", "value": "b6a1a77539b9427595e1fb5bce1e63c9", "object_relation": "md5", "Tag": [ { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632219293, "uuid": "6013aa7a-de8c-46d8-a324-d01a96b8556a", "comment": "Malware payload", "value": "b0337ad6fa6273b78e906f0d645049bb3a54dbae4aa64c3c56a3045a81dc1850", "object_relation": "sha256", "Tag": [ { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632219293, "uuid": "a804d2da-864e-4ffd-9341-edd7c14408ec", "comment": "Malware payload", "value": "6bb532388783cd65101db9d02b7326f88bf7dc1e", "object_relation": "sha1", "Tag": [ { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632219293, "uuid": "30e3bc31-77f6-43f5-8c60-e145d494d815", "comment": "Malware payload", "value": "62ce680a41e30bc2a143723f0b2456a304197b444b910df39cc59185a229eadf5b39df1a0759f7963b4d4468b8f44d70", "object_relation": "sha3-384", "Tag": [ { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632219293, "uuid": "f0d7f64c-86f0-4f16-bfbf-8160143eed8a", "value": "T126F6335759A1CFC9ED9E7475C2E31F0A538AB74B84A6D7AB4371C26B7FB1AB0C900810", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632219293, "uuid": "d90068d1-024b-44e6-8de7-12ce37dbe0a9", "value": "393216:Nw0E/Zbd7lwt2SiEOsCc3WohpZOjA8tb2:C1/hdqQ/tsCc3tpZRY2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632219293, "uuid": "555fe23c-4fcb-4dcf-bd3c-ffc5d79e6506", "value": 16075817, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632219293, "uuid": "0a026b8d-9fe7-4eaf-a0ec-d557aba57b41", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632219293, "uuid": "faa48dc3-f32f-42c8-bd56-2f4901052867", "value": "pdx8.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14b44bf0-1aa5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1632205686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632205686, "uuid": "f29a323f-84cb-447b-a3cb-68ffa45d8d54", "comment": "Malware payload (Loki)", "value": "9fe197156cdff3fabed047c3d9cb40c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632205686, "uuid": "fea62886-6119-4748-a016-2e177ff1b15c", "comment": "Malware payload (Loki)", "value": "b03bc075502514e1c5d65c599f0910d7ddc1c20f9b304d8421667013b68a6cf7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632205686, "uuid": "e0dbd1ce-9703-480e-aca5-b87113ecb939", "comment": "Malware payload (Loki)", "value": "38a62fb7b3961c9a864c2151c951462eda9fbef0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632205686, "uuid": "77d3944d-ad66-46e7-ae33-b5b24f4e1667", "comment": "Malware payload (Loki)", "value": "2a0e06be7bf293ed0e599d2cb294638a2e255f184c5b5047e6973d36c09ed9cc56a0b0e757044ee349579f2eba95f582", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632205686, "uuid": "0b7ebf9e-1b32-4d22-ac49-b9ee467497de", "value": "T1D2057DC43943A8DFF4DF99B3885E8C2065106DAE4216C33E2143762B99FF343795B99A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632205686, "uuid": "a608f67c-4c17-402a-8366-ea2f3dd64dbe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632205686, "uuid": "cb885235-8644-488b-a4ca-92ab7b4c9b09", "value": "12288:kcNeSsmtiK5oyZ/wD8C+C/VjUCGcCX4pURnuhmrC92Y0PX7CiKFIwUWVl8USkrKJ:kcNep+Fob3+YdUkpKuhmonK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632205686, "uuid": "27b1ce65-5f07-40eb-94f0-b5f591479107", "value": 826880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632205686, "uuid": "b919750f-29f3-454a-ab69-9f5f559e3545", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632205686, "uuid": "18244e3f-e54a-4678-b6b8-5fccfe74987a", "value": "Arajenlat keres Szam366\u00b7347\u00b7pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d67e26e2-1abb-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NetWire)", "timestamp": 1632215460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632215460, "uuid": "585cf7b8-25ff-4fa1-85d2-1187b3d55e4f", "comment": "Malware payload (NetWire)", "value": "2af4a0bdf5b656dfa94852e487aefeac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632215460, "uuid": "069ed841-7291-48c3-90c1-e3b0643668df", "comment": "Malware payload (NetWire)", "value": "b17c3b52340b1f33f4c2e5ce9eb6de617bd28c9525d12b56de031f5367bf7f9a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632215460, "uuid": "b6700c0a-9502-48d7-9ff2-b9050797a7f8", "comment": "Malware payload (NetWire)", "value": "7b21d088e3de361a26252ac376b2dc90fa8aa54a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632215460, "uuid": "a578c5f4-ac00-4dea-82dc-83245f634a71", "comment": "Malware payload (NetWire)", "value": "1ac7e0bde64af972f360f596301b82733ed5c1392c7d79ac3d359d72a1cd7fed9d62206cbb674ec6b7c297547f1e1ebc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632215460, "uuid": "6b585452-dd12-478a-97b8-7406eb876561", "value": "T130356BE3B344C8F6ED243D7DC80A6156A320BFF238439C4D9DB42A4A6EA5E54F94D097", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632215460, "uuid": "a893a348-9375-4dbc-9850-f615c99d7241", "value": "bc8cc1eea5c25ce2056d7da92bd98134", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632215460, "uuid": "246fe766-6ff4-404a-b30a-e468fe456f59", "value": "12288:BSZPsJUL/MN/cen/VwTQBXcameDCnNmPeoAdrL7+o:bOQN/cu/VdBXKyCnEOrP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632215460, "uuid": "87ce5dc7-dbb4-440f-90c3-619fe5aa8cd9", "value": 1080320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632215460, "uuid": "a1ac80b1-e287-43c4-848c-d60780c7e1c3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632215460, "uuid": "623a09c6-6c58-4306-9f73-dfc95be4bc0a", "value": "Quotation Sheet.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "088a7afc-1ab7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RevengeRAT)", "timestamp": 1632213396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213396, "uuid": "57a42fc7-617e-4515-8869-0392ddc43599", "comment": "Malware payload (RevengeRAT)", "value": "3632a4834bc8bb8e30036f9bb3f1fea9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213396, "uuid": "d29fdd79-68e2-42e2-8b21-015b04de9894", "comment": "Malware payload (RevengeRAT)", "value": "b195c22e15188d7a28301bddfea3a6790ff522911f0eb1069292db17bcb62fa7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213396, "uuid": "d1194d0b-64e6-4881-a417-96d73a231118", "comment": "Malware payload (RevengeRAT)", "value": "1fabb23ac29b73081a3c4ee7741fc94d963bb23f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213396, "uuid": "c088b200-5c5e-42dd-bdef-2fde29ba8b50", "comment": "Malware payload (RevengeRAT)", "value": "fd23ef9261c4c8dee1c7f3ed947428665c8fd9b39d595bffe544efaff4eb3cccf6e81f7108160e930780ae787c687262", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213396, "uuid": "e27ebc71-36a0-4fde-b386-73c1d131a83f", "value": "T15FE42331722FA76AE31B4570CB6A74C604F9D62036C365EA7D0798B30CF11A7D4A6AC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213396, "uuid": "31c64c3b-52f8-4830-aac2-4cd7a5692441", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213396, "uuid": "7d0e0815-e472-45e6-b5bf-3ccc77c58c04", "value": "12288:x2MKu3VRT0dvmDH82y92tSwV0YbmaV2yd6VjIl254//5FjKqgO9uYSFCYAO74M:x2MK5rXwxb/X5FuU9uYUZ74", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632213396, "uuid": "5d411a9e-e5ed-4675-bfe7-3ff750aa05d8", "value": 689664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632213396, "uuid": "2b87bedc-abf3-422e-9add-4f29642f8846", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213396, "uuid": "8f794d23-e939-46a1-8871-dfc7bd106797", "value": "b195c22e15188d7a28301bddfea3a6790ff522911f0eb1069292db17bcb62fa7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ebccc9f-1ac5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632219419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632219419, "uuid": "98388f40-b87e-441b-be5f-7d5fc05d0f7c", "comment": "Malware payload (AgentTesla)", "value": "38cbd97000d43a9e2303c891dc6a2f99", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632219419, "uuid": "1b30ea24-b3a2-4ef8-acf4-9f16c091f12a", "comment": "Malware payload (AgentTesla)", "value": "b285f3b7cffb5e74fb4fd4b7d632fe9f4b1133b6c04be55d7e20cbc38e1b873b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632219419, "uuid": "833f48de-ca9d-4cb4-a008-8603b1321820", "comment": "Malware payload (AgentTesla)", "value": "d6422e61929180a7b13a27c63408108745be7a7f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632219419, "uuid": "2bbf4abe-9b0f-42e3-9e5c-f0deaac51cfe", "comment": "Malware payload (AgentTesla)", "value": "261d2136e96c7923b979f8a9dd99f2307665621ac9d392236772585f68a2c0b7c479ba89ee0ee648a24d59da05b81ad6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632219419, "uuid": "aab299d4-09db-4195-9255-6c3e9e6864e9", "value": "T17DD412267AEE8959C78D3FB9209193807F72BD7A14C2E64D74DDB09D043B3D58E306A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632219419, "uuid": "b11fbafe-c9b1-407b-a317-d1db75ce5909", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632219419, "uuid": "96114acc-6d97-4f80-94e9-6aac243e505b", "value": "12288:hxIbw8eGGmtiK5okAFneqaGlbwqbWFsjvVQy1jK0fxoRLNW1mDLA0hZes01JGHYC:Abw8eGG+FokWL1lbBiFIQyZxEE1kLfIs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632219419, "uuid": "026e8138-1adf-4004-8150-fb43ab5622a2", "value": 635392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632219419, "uuid": "dd943e82-0e51-4881-bb71-3027092f6255", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632219419, "uuid": "0a9e9ee6-3e9d-40b3-b70d-e0ac999a6273", "value": "Bank details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "277a582f-1ad2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632225044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632225044, "uuid": "8d94344a-b596-441a-8758-22f6ecfb4564", "comment": "Malware payload (AgentTesla)", "value": "f63c67758bf75a025217cbc78d85d6fa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632225044, "uuid": "3f89ed2c-ba2c-4c5e-9164-16c71f6ad4b5", "comment": "Malware payload (AgentTesla)", "value": "b4aa2ef1176c6d851ee974c761e5c6b70e1a42db6be607379c7c61f6eba8a4fd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632225044, "uuid": "3f9da083-d400-4a67-89fc-d5289723bfa2", "comment": "Malware payload (AgentTesla)", "value": "588d66ba7cf7ae3c8f87b9e789c667b5533d0b0f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632225044, "uuid": "9b905a35-e18d-40d4-bb78-c516607cafd1", "comment": "Malware payload (AgentTesla)", "value": "44bd4d9e2db3b0416147bf1785adc9e263db0271401201d42b373afc7b483b56be236d34e926aff84cc5e3b34907d8d0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632225044, "uuid": "f5f60cb2-4b78-4547-ab3f-5809da016a00", "value": "T13AC423F37557B6B7EAD602B4176905AFF6E0E09D8C2BC3184873F8D61D52E0788A909C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632225044, "uuid": "6359b02d-b006-41a0-9e4a-20b4d4670a07", "value": "12288:9nYy5YqLuWPaVVySSIYxdqrjIDcReOS3jlXwCeZ9wId9HuSb:Zb3yWPaH6ygf3RAjnnXtb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632225044, "uuid": "af6be12d-7368-4feb-993c-d122cfc2f486", "value": 566005, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632225044, "uuid": "34bdab1a-58f3-49e7-960a-804f1f424b55", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632225044, "uuid": "2fb0fdbc-06bd-4afb-9796-1b962e18e105", "value": "Bank details.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "858c82fa-1ab5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1632212747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212747, "uuid": "be12f881-1152-47bb-9559-e537854ba2f8", "comment": "Malware payload (AveMariaRAT)", "value": "114fa215618dad1a512ab3a26bfd0ae9", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212747, "uuid": "607bfa17-9e14-4785-bb01-432abf421389", "comment": "Malware payload (AveMariaRAT)", "value": "b50fa76583465e3394b1eadb5eaa21db1cfb49a5e91a999549495668141545ec", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212747, "uuid": "d7e073bc-1327-4df0-9ea7-7c725e9589b1", "comment": "Malware payload (AveMariaRAT)", "value": "84551b5d8190c2d49e478b80f112fe267dbde745", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212747, "uuid": "dd024cd4-420a-4cb6-9560-a90c5acbef81", "comment": "Malware payload (AveMariaRAT)", "value": "5b61590295d4f248098cd66c1913f161d67f78f1df184efab7b3578642c47a9a8b9d0a19e0e744edc8212b669f1545e9", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212747, "uuid": "ad33f87e-762b-4b53-a485-53dc9c389f43", "value": "T17C361254B51EF9B9E409BBBD14A3620B573DAF80EB4DE2F324C0EE67054B72806B3591", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212747, "uuid": "861a6e2d-25c8-4f78-9453-d2788e1ebb42", "value": "084fafd5fea9d39b4ff35f2d82f0908b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212747, "uuid": "174abd3b-2f3b-4c6d-ba9a-c132cc1f01c5", "value": "49152:ZXyHQx7XXUXHhVt19DAnIJLbRwDSrWFA6ofvv/DfsGOb:ZiHU7UX5D3CDSrWFA6ofvvbUGOb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632212747, "uuid": "18ab2fbb-2b2a-4030-9284-15513a7e09ec", "value": 5154337, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632212747, "uuid": "b51ccdb3-f6b2-4e46-9348-b685efd2ed01", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212747, "uuid": "10c7da99-50de-429e-8a71-0f18ae169fdb", "value": "b50fa76583465e3394b1eadb5eaa21db1cfb49a5e91a999549495668141545ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e5bcdb4-1adb-11ec-8fa1-42010a9c0011", "comment": "Malware payload (OskiStealer)", "timestamp": 1632228868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632228868, "uuid": "f49f00ad-be23-467c-9f62-0d174da6deee", "comment": "Malware payload (OskiStealer)", "value": "ff78d8bb9599aab5499aec11060c5a52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "POL", "colour": "#244A04", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632228868, "uuid": "0e7b3bcc-0bfd-40d9-ad58-bff92d9e271f", "comment": "Malware payload (OskiStealer)", "value": "b52667bbd4f7c03e8384a218fd44ff9fc76741a25baf8b658205191433914baa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "POL", "colour": "#244A04", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632228868, "uuid": "68c2bc74-234f-40d1-9eb2-3c835ec21644", "comment": "Malware payload (OskiStealer)", "value": "0d3c255f9cdd9e123c91e7819ad2e318a0aedea0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "POL", "colour": "#244A04", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632228868, "uuid": "d6179ff6-83a7-42ac-8510-fa0a43e08db0", "comment": "Malware payload (OskiStealer)", "value": "b6e28387e586cfe342d581de5c62417eef7354d76cc19ae7cacb363b830ab3d96209d122840184e49187235da8169163", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "POL", "colour": "#244A04", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632228868, "uuid": "3856e4d8-12e5-48f0-bb88-a108315c2395", "value": "T16B356DE3B794D8F2EC34393EC94A711123256BF27C234E4D9D603E8AA9F4A50B9595C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632228868, "uuid": "6f20ee7e-ce4c-451b-877c-06c7e0cf238a", "value": "bc8cc1eea5c25ce2056d7da92bd98134", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632228868, "uuid": "7095f9e9-dc8a-45b3-90e5-41b8f9cb4380", "value": "12288:BSZPsJUL/MN/cen/VwTQBXcameDCnNmpeoAdrL7+o:bOQN/cu/VdBXKyCnEorP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632228868, "uuid": "a9da53ce-dae7-44fe-87bd-141720ad0757", "value": 1080320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632228868, "uuid": "6c1714e7-68ba-418a-8207-4f4ae706cafd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632228868, "uuid": "109918c6-5363-444c-b238-a0f4e6363ed8", "value": "Zam\u00f3wienie zakupu # 49211.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "730ac6a0-1ab5-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632212716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212716, "uuid": "128407c6-16fb-4c1d-9acb-561268a8e827", "comment": "Malware payload", "value": "76be274011a3820d62ca7d3d6b25df3a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212716, "uuid": "a9848a60-81fd-4671-88c2-d26e9eb0148b", "comment": "Malware payload", "value": "b598d31a28b5a2de68b81e4b22607eac63df1a19e8d297ff9c28dad2d2889859", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212716, "uuid": "2d04ca8a-e99a-4b67-82a1-3dd753992e14", "comment": "Malware payload", "value": "9777fc79bd644133e29e2e4308416beed96ca97b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212716, "uuid": "1ae79822-05e6-4f7f-b69b-15b44c25bd2d", "comment": "Malware payload", "value": "35d9e75950b7d049329fc4f1f7943a6238a02cc7afba377020227e4cefdbfe100d786fdbcdf4317dfcaddcbb4bb2b646", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212716, "uuid": "4718754b-5e6d-49e3-a147-e10e99a8e6ff", "value": "T1AD567A116F731EF1D2147AFE9213C7526B0E7EAE1529EB4FE818347CE80918E716826D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212716, "uuid": "843b7c33-2e65-4221-97b5-a8903aa69189", "value": "514c554c4eccf8b5d18d8453867113c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212716, "uuid": "d9dc1d02-d4aa-4539-9a02-a8a9d4ba5d4c", "value": "6144:PFKiOzC8VEXAouuoSewRLqeHa8uEShEsEp+tPqrKgGRV1KemU4v/bux/bux/buxm:PHkVE/oSvJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632212716, "uuid": "a9718778-255f-4a42-8c62-e6beacd0f907", "value": 6178898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632212716, "uuid": "edd859dd-1644-4eb1-b46b-2a078012fb5c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212716, "uuid": "7e845089-5193-48a6-9532-e4f9874ecf5d", "value": "b598d31a28b5a2de68b81e4b22607eac63df1a19e8d297ff9c28dad2d2889859", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edc63de5-1aaf-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CobaltStrike)", "timestamp": 1632210345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632210345, "uuid": "bd9f2a27-2aca-4b44-8902-d3161a738111", "comment": "Malware payload (CobaltStrike)", "value": "cb4ec6acf692ee849f86420e66cf458d", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632210345, "uuid": "b71c0627-f710-4d19-9201-95afeb325adf", "comment": "Malware payload (CobaltStrike)", "value": "b5acce41fd46b4691f4527d403d150fab365a557bc572d7e147a3e99eefca013", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632210345, "uuid": "24dd7dee-068e-4abf-97bc-3efbfa82d340", "comment": "Malware payload (CobaltStrike)", "value": "049d6d6ca10d07a1ad38f14b88d8c69907f8eb04", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632210345, "uuid": "b581d5d0-b32b-4d42-93b2-868ff4fe18bd", "comment": "Malware payload (CobaltStrike)", "value": "d1e7f0a754d630c5a8617de6bc43b038ad6be15f81eb6e785c34267c255c443ad8e12ca756773fde2d95bf6ff44fcb83", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632210345, "uuid": "9abeb04f-1cf4-4246-b444-b851ab4ba545", "value": "T15F24DEB5FF66743FD03D0A37DDD990B9AFEAB1434CB7E2C989155AA805980D4878028F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632210345, "uuid": "8433d8e8-1512-4a3f-b873-e318c72c85b4", "value": "829da329ce140d873b4a8bde2cbfaa7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632210345, "uuid": "fe3aba4f-b8a0-4389-8c0d-ded80c290814", "value": "6144:xw5TcbChUk1k2h/twlMRRFa6NkIMUYr9W:xqTXuk1Th/tlt0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632210345, "uuid": "fdb01190-e409-4e56-b1a3-29839688391b", "value": 226816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632210345, "uuid": "bf48d499-947f-4515-8a71-2988036ab49c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632210345, "uuid": "1c0c48d8-f6e9-41c7-be3b-3ae27412cd7d", "value": "cs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1c1f259-1ade-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1632230538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632230538, "uuid": "cc74a171-7749-4a72-b60e-461647d85d15", "comment": "Malware payload (ArkeiStealer)", "value": "9c4bf60ff31d08cdcb70b24695849bff", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632230538, "uuid": "7081c14f-28f4-44cd-9f7c-ad4e63556d46", "comment": "Malware payload (ArkeiStealer)", "value": "b6178d35d1973c2ed531152fc2f048484525498e4fd2a962b411936679fbd6d2", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632230538, "uuid": "f1fdded7-77e2-4288-9f14-1bf7b7366a25", "comment": "Malware payload (ArkeiStealer)", "value": "9a02dd585112e3207b2a14ebd6fd0c3a7f58942a", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632230538, "uuid": "caf6ee93-a8d7-474e-ba70-35a4e0afa793", "comment": "Malware payload (ArkeiStealer)", "value": "29d9aa800d272b87aefd7dfe175149ac788be32c5387517d90cff5903102944b0a8efdc4f1d052302d53160c15cd709f", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632230538, "uuid": "ecc00116-319f-474e-b4ee-486769056c66", "value": "T1A865E121D292F437D1A3F638DD969B7F9B3CBE103914140B6EE82D685B39380B619367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632230538, "uuid": "fbfca84c-d474-4500-b716-b21154fab82f", "value": "c32368f78c61cf2d9d6654d89861a9fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632230538, "uuid": "743f41f4-241e-42a1-ac8a-a39e6cb55e82", "value": "24576:HBuzcdGnDDd8WHA4NKRi9yvbEx2Tw1zRHEH0OhgcoAs03kzGl/rHw9I1u1dA9mvo:H2D3HAl8gDExIE006gcRf3Vl/zw9I1uX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632230538, "uuid": "f4dc5782-7096-4eb5-b147-8d7c0ddb0dda", "value": 1534976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632230538, "uuid": "b87ee0da-428f-4aba-9ad0-c4aa3ff80404", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632230538, "uuid": "1f7214c9-30c8-4f34-95b4-35d13d912f15", "value": "9c4bf60ff31d08cdcb70b24695849bff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "978c0171-1aa6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1632206335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632206335, "uuid": "0fd82820-8bae-4042-bd14-3a4465955f03", "comment": "Malware payload (ArkeiStealer)", "value": "9495761e569d1589af99bb520cd01a54", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632206335, "uuid": "fcd4e5d6-49e7-40fa-bad1-4ac709534aed", "comment": "Malware payload (ArkeiStealer)", "value": "b61909aa48c3bd53bc5c94589078acba1a719998b4bb3be33a6207c104771dd1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632206335, "uuid": "be51990e-e399-4d80-b2c0-8a5886206006", "comment": "Malware payload (ArkeiStealer)", "value": "7e8a2be7e57e3cfb11e29ea5afd6359dd5c2a35a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632206335, "uuid": "634e8ecf-201b-4419-a905-d5dc1413c9aa", "comment": "Malware payload (ArkeiStealer)", "value": "8a6d29d8935a5b01dcb737e34de17c0613c71b69a504ceca906e5dce05a6451a2547433a2b711c7b0f7c2436980e0fbe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632206335, "uuid": "081df1de-04a1-4648-9e85-3f430aab1f2c", "value": "T1DE55C7E4B94D8C73FCE8363816D31D5C29293FC3B02D358F71AEB569A96BE81A945D00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632206335, "uuid": "a94f552c-46f4-4820-b7d5-ef0943b20f6b", "value": "5511694027f5c5aab51d18a076c7a70f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632206335, "uuid": "9600a22b-f876-4cf8-bda6-ce4288d40099", "value": "3072:OpGSYF1aI2LsEBsabgMArKjXGI3UbSLctvkn7aOKzXgVg3Zeu2GBlF0W:qFYF1aI2LsYsGsrKD03vplF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632206335, "uuid": "9471ada2-718b-435b-b6b2-bee0673d1e6a", "value": 1361920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632206335, "uuid": "bb28daa6-5def-4abe-9e9f-18c13578a9af", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632206335, "uuid": "c859e452-970e-475c-9660-12d3049d0263", "value": "9495761e569d1589af99bb520cd01a54", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bf6a741-1ab6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632213133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213133, "uuid": "6f0b7a70-544f-4337-86ef-cca824f50715", "comment": "Malware payload (Dridex)", "value": "5f7c550ba8eb77b0587a5178979530ca", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213133, "uuid": "8e15c94c-2c07-4068-b301-2cccac4a38c1", "comment": "Malware payload (Dridex)", "value": "b681869f6acf80d0a64f2642771701f7fa50e1b4537d445e481a6a0d1657691b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213133, "uuid": "3b35a5eb-f835-4722-bd5b-60545b8d1768", "comment": "Malware payload (Dridex)", "value": "dd9c3cb4e49929dd3c90a1fe173c6f9638d576e5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213133, "uuid": "541242ba-e67c-4899-81ae-83e125d13534", "comment": "Malware payload (Dridex)", "value": "4016e0d3cac8fe35e50299056c56dec7a6ae98d16074b65ce82dc0610be1aa126703eab740415cfcdfdd34e402c5a7fb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213133, "uuid": "7dacf95d-d78c-4ecd-9c25-2ca7e1aee3f3", "value": "T18385D020EE69E1E6C6B89F3E9408352727F93D75110D608CC392704F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213133, "uuid": "4e0a7cd1-b115-492d-9c3e-0147efe0af24", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213133, "uuid": "a47029b4-51ac-44e2-ae06-1930dc2b3635", "value": "12288:hVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:QfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632213133, "uuid": "58d41f49-5141-4899-a017-711039a37f33", "value": 1789952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632213133, "uuid": "8b46ac89-6365-4b88-948b-0c6439237e87", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213133, "uuid": "3dc9d71d-a21a-44e4-9112-2dd90464553d", "value": "b681869f6acf80d0a64f2642771701f7fa50e1b4537d445e481a6a0d1657691b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e787e92d-1a7e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (STRRAT)", "timestamp": 1632189289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632189289, "uuid": "d31e5a04-c87a-4ca9-a158-58ddc412df6e", "comment": "Malware payload (STRRAT)", "value": "282ad447f7211b4bbd7012ed64e8bf57", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632189289, "uuid": "f17624df-74b6-4467-afc9-d8bdc16c021a", "comment": "Malware payload (STRRAT)", "value": "b6989008575af7e2737c9038669a043ee498253423ab784b39fa53505413300f", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632189289, "uuid": "896ebfc6-3cf7-4994-ad38-af4968dc40a4", "comment": "Malware payload (STRRAT)", "value": "9041ca4100055601191809f8a79c3e920aa1f9d0", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632189289, "uuid": "58e9eaf1-fc52-470e-8095-c0c6b0c27ceb", "comment": "Malware payload (STRRAT)", "value": "e7f97ae1a22f59556cc336c0dd6c11ad85e7573369a988cf1b218bc007cd9226b416d36a0b8fc32b155b4aa456bcac3f", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632189289, "uuid": "c10ae829-51cd-47b7-a1d0-0662006f7cb6", "value": "T120C31272C0B8B82ED5F7AFB731D12B0120C829D258217E66309FD0DB75D4D096AAB76D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632189289, "uuid": "664cbd6a-2510-4be3-a89f-7d0cbd40bf1c", "value": "3072:sC5itTxjoj96W6+QnHPiG96jcIRo2p87PzTkGwEjiesS:T5iZ5ownvJlx2p87PzThiI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632189289, "uuid": "d2068f79-073f-49c2-a5ee-ac39551c8d28", "value": 118451, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632189289, "uuid": "ff632173-3f22-4e0f-bcd4-121d641009ca", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632189289, "uuid": "5f60e3b7-d1e9-4bf1-a9f6-72e036493d52", "value": "USpstracKER.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a584de36-1b10-11ec-8fa1-42010a9c0011", "comment": "Malware payload (QuasarRAT)", "timestamp": 1632251885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632251885, "uuid": "67293cc5-8f66-4f8d-81f1-b80d555cf895", "comment": "Malware payload (QuasarRAT)", "value": "f56d628b7ebaa781a0dee29759c60a8b", "object_relation": "md5", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632251885, "uuid": "51421271-71c9-479c-822d-d1d519f28db7", "comment": "Malware payload (QuasarRAT)", "value": "b6e510ac38643fbc455d38144a8ab0990056379c596c5728987d062fa3a64efc", "object_relation": "sha256", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632251885, "uuid": "5bee9780-f7f5-49da-9b7c-a349883ea164", "comment": "Malware payload (QuasarRAT)", "value": "fe74387d22dfd57581bf3c1978d32282b439a25d", "object_relation": "sha1", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632251885, "uuid": "614ef34b-d9bf-42c2-8b4f-281e363560c5", "comment": "Malware payload (QuasarRAT)", "value": "0cc1f1d8fa3f45c0ad1b87b0f4987c017609cdb17b07013d5e310fe1839bc97e9ace01c06a5b3c49e20139af36f9a305", "object_relation": "sha3-384", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632251885, "uuid": "0fa8bc0f-41c7-4ad5-80b0-2cc8c95e847d", "value": "T1D701BD5C1E0DCCBD0B4E439758B3D59E9BD42346A462DA94A280DE88112832C1A418EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632251885, "uuid": "0c601bb7-1bbb-4ef4-9f08-1f250cb7ba8f", "value": "24:n9WYsKI5dw959s2xQsYvAU8sh9GYsZ5F3sEqiDZ5s1IsghYsPQt:0rA5jMAUF9G/FDrZ3Qt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632251885, "uuid": "064a4414-07c2-437c-bc2d-746d25b9b9fe", "value": 785, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632251885, "uuid": "5032cf22-4ac7-4ea9-a7a6-78fbd2394ed3", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632251885, "uuid": "6e44dea6-8d3a-4b28-b69b-f944fb1c458c", "value": "7894512145784512512.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f8ecd76-1ab6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632213086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213086, "uuid": "ab6288a4-8bf8-4fc1-8bc2-14659f227a08", "comment": "Malware payload (Dridex)", "value": "b788fe00712238512b6f966a466b912c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213086, "uuid": "4386dcf6-6881-46f9-8a87-77ee5e05d26e", "comment": "Malware payload (Dridex)", "value": "b7a5bc6a2a19ab52b533fda0fc3e819c56a76a5c225c973a8239bb05f8ac9672", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213086, "uuid": "320a3adc-1041-4f44-86ba-264245a18eea", "comment": "Malware payload (Dridex)", "value": "c72f59fde95e08fb4591e1971bdcba78c98a3cc3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213086, "uuid": "d3a97426-4b73-4db8-9535-5fca88fd978f", "comment": "Malware payload (Dridex)", "value": "13866f6d1191f6c2733446482e6b20a8ab65b4a2aaeb3d1f5bf3571d54b59de8e1f946ae06d2c1570be29c98b0f3127d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213086, "uuid": "6147aa04-e401-4026-8ae8-7315862b26cb", "value": "T1F5A5E020EE69E1E6C6B89F3ED408352717F93D75110D608CC392608F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213086, "uuid": "d1044952-e4e7-4ade-96bf-98c5fa591d26", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213086, "uuid": "4cf731fc-c58e-4be1-8614-4d285030c5ab", "value": "12288:WVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:LfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632213086, "uuid": "3369f497-bce0-47ac-a30a-4662ff7443f1", "value": 2093056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632213086, "uuid": "69f7c95c-3606-4a90-b632-9baa65df9d88", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213086, "uuid": "61422131-4a31-4e87-bce4-c13f218a35c2", "value": "b7a5bc6a2a19ab52b533fda0fc3e819c56a76a5c225c973a8239bb05f8ac9672", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8636f431-1ae8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632234652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632234652, "uuid": "bdba2199-289f-445d-9e73-4750f24b62eb", "comment": "Malware payload (AgentTesla)", "value": "bb9f90862cf8c10b1527e21cfc0ff147", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632234652, "uuid": "3dc0a72f-d3d3-41c1-864c-411163b76332", "comment": "Malware payload (AgentTesla)", "value": "b7f857d061ede326fbe279de6381797f097ee7873e2af34c5488bc91fa819d79", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632234652, "uuid": "32b65e41-5d9b-4856-96f8-49496f86758a", "comment": "Malware payload (AgentTesla)", "value": "7e2875ac5d67ee10abf93e9aab0475f488e3795c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632234652, "uuid": "72e69ea4-70a1-4176-9075-8dad7ae926a7", "comment": "Malware payload (AgentTesla)", "value": "7f6d21d1079a5965cd5802f52696ae67f01144f0f9c316e7a48cdaa568cb04ae6241d0c6f52d4f7d209bdd61ebc151c4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632234652, "uuid": "2ff9169c-f70a-4241-b531-889151ac7cac", "value": "T12094397132C2FE9AD63A0878DC04E5A04C951DEF821343A9F649F9FD63B71F499A8871", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632234652, "uuid": "f55c93df-1b7e-447f-b0f4-6a749ec2cea6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632234652, "uuid": "10e8a97c-c863-4af2-8382-420c186605a1", "value": "12288:QEMHj6Pzhqdqf0dWFwyud8bKyMCbo+CC5RYkakA0:TJeBdXCvjDakA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632234652, "uuid": "9aa50234-0e66-47c1-baac-08ede1d131dc", "value": 447488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632234652, "uuid": "c2c7435c-077b-415f-9415-af740a8ead6a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632234652, "uuid": "372e4db4-57df-4951-b788-a5a7893033a3", "value": "SWIFT.103_1873530473.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd12e4b3-1ab5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632212840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212840, "uuid": "dab61ae1-7c71-4c8e-b3e1-d454ae4b11a3", "comment": "Malware payload (Dridex)", "value": "847395bbc8922e89d72bb0d1b958c3cb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212840, "uuid": "1b85d174-bcba-4d05-a05c-8f0f6c328557", "comment": "Malware payload (Dridex)", "value": "b8cdcf0dff1ed92adc0ce8e8180628a1cdd35130a4d77ea510e03d958727288b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212840, "uuid": "3ad982ab-5f84-4d58-9cf0-8c3d9134c010", "comment": "Malware payload (Dridex)", "value": "8967f984d710a9e3763f6e55a570ba4e7cbb78f2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212840, "uuid": "ad7e5d7a-c79d-4637-9d06-f0a36ca17f98", "comment": "Malware payload (Dridex)", "value": "19538220d1ba952664258e388ee34cfd4d5abfc862e25ccf28da795802a59b37876e37c25887579fd024bb2324db5abc", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212840, "uuid": "bcb82a97-35f1-4055-937a-ed3da0f6f250", "value": "T13BE5E020EF69E1E6C6B89F3E9408352727F93D75110D618CC392604F5EF82546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212840, "uuid": "54e0979f-8a03-4f69-95ef-18f805278ec0", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212840, "uuid": "9d9c6f22-f2f1-4dbd-aebe-fe8b41d9561c", "value": "12288:sVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1s:ZfP7fWsK5z9A+WGAW+V5SB6Ct4bnbs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632212840, "uuid": "b745b601-c494-4814-b027-30b40e0e9f2d", "value": 3170304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632212840, "uuid": "13c9ce55-30be-4265-8bb0-a6ffc6a2536b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212840, "uuid": "ac58c63c-b47a-423a-98ba-75c0e9e59b1f", "value": "b8cdcf0dff1ed92adc0ce8e8180628a1cdd35130a4d77ea510e03d958727288b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97b1d364-1afc-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1632243272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632243272, "uuid": "1ed42800-4a96-4252-888b-d7668e4afa17", "comment": "Malware payload (RemcosRAT)", "value": "b8815a518089222dd6e48341df39c4bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632243272, "uuid": "7ec6aa21-391e-40ae-8385-564f1a4eb1d2", "comment": "Malware payload (RemcosRAT)", "value": "b8ff5642173ea1664b856f47468ebf4778be3154b7b0a6bfa6a0950f51973c69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632243272, "uuid": "f6be2cf3-e33e-4f0e-b379-b14b0f66edc7", "comment": "Malware payload (RemcosRAT)", "value": "443d2fefd67e9a01b16131f57b7ed10a95f72426", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632243272, "uuid": "06109abd-fcc6-44fc-9106-7b8053483842", "comment": "Malware payload (RemcosRAT)", "value": "1561c7266d7b06559b98d2b76585d6aa7c0bc22d65536f85d7cdd97f4431036a945c0d587f5aee15d3a65fbc6ad96da4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632243272, "uuid": "07e26e09-0d6d-438d-ade7-3e1c76748ab1", "value": "T117356DE6B3C0D8E4EC207E3ECC85B2815316B7F629668C8C6DA47E4C19A1A51F4BD45F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632243272, "uuid": "87a4ebbf-1b95-42d6-b743-4380a8759948", "value": "bc8cc1eea5c25ce2056d7da92bd98134", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632243272, "uuid": "e6bb5bd2-5ed6-4cf6-8241-4412bf457e7b", "value": "12288:lIspEfnP8N/seflQTshT8aqeTW39Kq6eoAdrL7SUbDz5Zp:320N/seflZhTmiW3A6rPzz5Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632243272, "uuid": "10a33f2a-c38d-4975-aa8d-e88fd8e61066", "value": 1133568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632243272, "uuid": "ee701a1f-0ba5-48f6-947b-83457e6bd360", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632243272, "uuid": "6db27fa1-a1fe-4f25-b719-97d970912329", "value": "Urgent RFQ_AP65425652_032421.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c23b4ec4-1b11-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1632252362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632252362, "uuid": "4437a692-1c19-464e-b0cc-9b7a2bcbeaad", "comment": "Malware payload (ArkeiStealer)", "value": "d25e65e5d92f02c31bce7a29e9440992", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632252362, "uuid": "5d129905-49fb-44ff-ba8f-4c0d1abd1768", "comment": "Malware payload (ArkeiStealer)", "value": "b92e4e813f779135b6c1f0a78e945efb9f14d015e9ae7b4e810d5bdc69299593", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632252362, "uuid": "da053834-e95f-4136-8b5a-768a7a364751", "comment": "Malware payload (ArkeiStealer)", "value": "577ce5a738ffdec0b28650e7e4d52a96690a20f0", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632252362, "uuid": "46934c9c-b673-4054-ac7d-8f86a6808600", "comment": "Malware payload (ArkeiStealer)", "value": "0451307704fc2420458f8efee35aa3b42693951850cb7dbf3cebf8e53cc19a5b415b1344f9a741c42fcfe70a5230e71e", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632252362, "uuid": "898a77ab-47ab-4404-800c-bd8ccd41e731", "value": "T1D6E40112B569C331C6F75071472CBFE12AB7B82259B483876B5A23BEEF642D07B11349", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632252362, "uuid": "78aa77a1-9f61-4385-9aa7-d19c59090e3b", "value": "98349bc8fa025f57a9d49df3092c15be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632252362, "uuid": "88e7cb19-7510-41d3-acc1-2ab043902875", "value": "12288:f5ILlHd+0kxGbPp2tWb8dk4BzSCO/ON5uF4EtBEVi64GjAyvpBai:f5w+0kxGbPp2wb8m4BzpO/ON5+Bmi6KI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632252362, "uuid": "8784f42d-2648-455c-a5ac-cb9333daea70", "value": 673280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632252362, "uuid": "fe8b96c2-432a-40ba-a79d-de23cf62f073", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632252362, "uuid": "bedd84ec-9ae6-4e73-a567-7ea42b8b0955", "value": "d25e65e5d92f02c31bce7a29e9440992.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "456d9173-1a75-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1632185151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632185151, "uuid": "d88aa04b-89ca-4031-8f3f-ea81389c332c", "comment": "Malware payload (njrat)", "value": "a26b443ea78fd638b20845e33660c17d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632185151, "uuid": "8de0e13d-a0eb-4967-b6eb-a7d1d61d948c", "comment": "Malware payload (njrat)", "value": "b96d9319d131de965ffca4c9e3ede73783dabf45de05bbe0bf21656f2eb2a32f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632185151, "uuid": "b3e371ad-c5b9-47b5-a661-cb38ec6d8bec", "comment": "Malware payload (njrat)", "value": "4aa93eec26752fc3e3907de83fcb1e66ca5a619b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632185151, "uuid": "53e8eb74-6179-4186-aba5-60428795f1f0", "comment": "Malware payload (njrat)", "value": "caf5934591d43a21f7b86fed1cc4a56034e9fab15754495cb99ebcfa5fc3bce7c7fbe72ec4634d35b44a249c099469bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632185151, "uuid": "3452a8eb-1563-47f9-be27-759e9455994e", "value": "T18C54F7E11593069FCC2E2DF18D017D54C9DFDFBBE5A054BA612CB528C9BF2C1128A2AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632185151, "uuid": "fb6be45f-461a-4135-b938-c68bf57a2e42", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632185151, "uuid": "477b58e3-b0a0-432f-9291-b9bcc7242abf", "value": "6144:fp140kYW/gyTHm5Cudvb6W4BAHYzXbhPjap88888888888888888888888888887:fpO0ZT5xvbsKMhuV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632185151, "uuid": "63e5a9a5-1c48-465d-893e-440d83200ad6", "value": 300544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632185151, "uuid": "8cf5c124-cb41-439d-a884-692102235f14", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632185151, "uuid": "145cbba2-7bcc-42ee-9b40-0a67cf3735d4", "value": "a26b443ea78fd638b20845e33660c17d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "701072c5-1ae5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632233327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632233327, "uuid": "bce8ad04-4cbb-4ad2-a0a3-164cb6bb06e4", "comment": "Malware payload (Dridex)", "value": "a5a16095b9f28ade6a31a17f49ce00be", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632233327, "uuid": "29e705b1-a65f-416d-8c5e-aa4d5e945cb5", "comment": "Malware payload (Dridex)", "value": "b9f2d0a3ef79c8883be9adfa938d1dea808b46a2f71e56f7c0ca937922e0c971", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632233327, "uuid": "361689c4-c356-43d0-9a28-ccc089ef6f68", "comment": "Malware payload (Dridex)", "value": "ea6b79389659d69085b168e3105d7c8dcb6ab7bb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632233327, "uuid": "419c2d6c-79d6-4bfa-9e68-c6cb1c0e7163", "comment": "Malware payload (Dridex)", "value": "9b721113a17652cd67a81bfcaaec32abe408df50f9f4105fccaf1beec9e20f77e79539b6c40403c9309aa6c43af7756e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632233327, "uuid": "bb53e2b9-5ccc-4200-83fd-043e0d7a420a", "value": "T17615F10277FC9E65C4BF063518368770877ABC226A64A20FA7D13E4E3D727E20952376", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632233327, "uuid": "901f6bb2-f7ab-4f89-aa6f-fcd7d83a881c", "value": "19397ec56e410d73e90f5bdc3f7f9986", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632233327, "uuid": "adecc95c-093b-4e93-a089-b18bfbc25c6d", "value": "6144:nwK6cyPiWCgknQ/HuyIzuTVzsMM56519p+6yTSm64sl3oyBC0+eekTdFyDPckaS:wM+ZdkmHubeaCo6JVl4CvODPL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632233327, "uuid": "5e39b386-ea34-4546-b620-7460821db91f", "value": 896512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632233327, "uuid": "d9540bdf-d17c-4813-b64c-0983b45c0c0f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632233327, "uuid": "714bcf50-517b-448b-921f-e8aeb383ccf4", "value": "a5a16095b9f28ade6a31a17f49ce00be.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2532017d-1ab7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1632213444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213444, "uuid": "e86bcf3b-6f51-4e5b-9140-da2de3338cd4", "comment": "Malware payload (AsyncRAT)", "value": "41deb852009dee8341b1862142c45e79", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213444, "uuid": "52c2ef84-4d61-41c4-b86f-3f6bee7bac9c", "comment": "Malware payload (AsyncRAT)", "value": "bacd5989c0f8aebcceb4f6268ed626d587d324c91ab45799c5c05d03f196e1d6", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213444, "uuid": "116ebadf-cc3f-4980-b881-f796466f44ec", "comment": "Malware payload (AsyncRAT)", "value": "29d04c1ab468338690fd75e11a595ba3a52a0b11", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213444, "uuid": "2ce693c7-2b37-4d72-9b3a-dc57a08c753f", "comment": "Malware payload (AsyncRAT)", "value": "743e3d5837d865fe311b4bfc570d1c620c56561b13ecb584563ea8143bb35ce721d64a271da3837f28f5409df1828893", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213444, "uuid": "2a23dbb0-bcdc-4645-b303-df21483b8f59", "value": "T108057C32B3D3D1B6EF6225F2C5B507320D39B836073CA6DBB390282EE9916C16A75355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213444, "uuid": "94ced74d-7d6e-4abc-881b-44fd7fed952c", "value": "46978de0f8944a65af1673d613222a98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213444, "uuid": "de0be5f7-ce43-4b3c-b1d7-8a89da008124", "value": "24576:bNR2zaQBt37/CZ0w1PeWnzqhqCC6+PEj5hX:KUsrC6aEjn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632213444, "uuid": "c31f427c-5a29-45b3-8c2a-ae04fe2af995", "value": 872960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632213444, "uuid": "3e3ce547-7f52-4d69-8ce5-bfa9feedf5b2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213444, "uuid": "bf589d26-9245-4cc2-89a2-34b0fe325da2", "value": "bacd5989c0f8aebcceb4f6268ed626d587d324c91ab45799c5c05d03f196e1d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ed3c833-1ab7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1632213434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213434, "uuid": "80885df1-33dc-4fbf-aada-ddc856373c69", "comment": "Malware payload (njrat)", "value": "a9e54bee0e66b97ea49ef36541badc40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213434, "uuid": "ca393826-5646-40a7-9ee2-2288cd01e498", "comment": "Malware payload (njrat)", "value": "bada316b9905a1d13297dca91f12c2f4a666bb9bb14c05dc78a1aaa9d319721b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213434, "uuid": "227ca121-4eea-4b4f-97cd-3b7058fdcbc2", "comment": "Malware payload (njrat)", "value": "846dbfb84c93c05d4f5d3e08f0cc02d8ec04b5db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213434, "uuid": "144bdcd5-f0e7-44ea-beae-71f845136d4c", "comment": "Malware payload (njrat)", "value": "4306292df13c14b0749e8a8337c73daeddae583899260298d901f0088000e538f2bfee889fe63cb8b3df5a3cf84950a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213434, "uuid": "53dc6ea1-ddea-46e4-9c7a-6b74d7235b6e", "value": "T1310523533286D764C95696F32A3502C567A0A756879BB34BF12CE3249CF372A1FCC293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213434, "uuid": "05d6bcf7-7cfd-484b-b1f3-a166fa0ba1c5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213434, "uuid": "349741a1-6e3e-41a2-ae16-a9dd521143cd", "value": "12288:vD5Od/XJFdRIZImBtYFwDqFKVygivgfT1hqS6HoCvcLnJR0GIVJhEJogaPNQvhA4:vK/Xx6ammp2aXnGQSa1QZAz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632213434, "uuid": "593db4b1-b116-4a8a-a0c8-f51c90428133", "value": 810496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632213434, "uuid": "69026f4f-252c-435e-8e33-0592d36e0123", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213434, "uuid": "08a0d2c8-3e18-44a1-a1cd-1152d44f092f", "value": "bada316b9905a1d13297dca91f12c2f4a666bb9bb14c05dc78a1aaa9d319721b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36333afc-1ae0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632231082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231082, "uuid": "09574ab7-e77c-4e9b-ace1-84f2a9472ac2", "comment": "Malware payload (AgentTesla)", "value": "aacf3f0c0f6237c0c6dca61a2605a16c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231082, "uuid": "b7094f09-6fe3-4db0-b455-68aa5c889a76", "comment": "Malware payload (AgentTesla)", "value": "bb028c0704e6c102b16d7d4f714d909ed0db276685f2c5add3635f39b897861b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231082, "uuid": "375d09fd-8b6d-4e89-a045-5ade0aeaea6d", "comment": "Malware payload (AgentTesla)", "value": "07ee1fa9c5799345b85805ada844247c89de49ec", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231082, "uuid": "33a75e56-9412-40f0-873e-5c4a79347a8f", "comment": "Malware payload (AgentTesla)", "value": "875d432d0ca030bd2dd274cc4b133d1b9487838bfd80f595e7ec7e8309bee3eaa3cdb9b1c94c34b9b66fca7e14cc3611", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231082, "uuid": "44fd670f-59c9-4f44-a0b8-26b8947d4a88", "value": "T109D41242B6BE4254C79A7BB5206193917F77BD7A1837D68E26CC308E0B776408E35B32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231082, "uuid": "b0fcb25c-797d-404a-83c9-8e2910a3e752", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231082, "uuid": "81fe8431-0c4e-4656-9076-18fc8edbff7a", "value": "12288:CuIbw8eGGmtiK5oj+Atifq1jRc00KF1xLhetNS50LBZyPWU:Abw8eGG+FojNUUjRXB99g9ZJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632231082, "uuid": "33ddb383-7494-4adf-a6c7-68a16d516003", "value": 633856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632231082, "uuid": "525a50cc-08c3-4b98-9132-a827e3edd038", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231082, "uuid": "2ff5a6c1-919a-4ead-b349-0515e58deee4", "value": "aacf3f0c0f6237c0c6dca61a2605a16c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b72d057-1ab1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632210851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632210851, "uuid": "a9fba9c0-c97d-4a1d-ad07-ae53b7441ea3", "comment": "Malware payload (AgentTesla)", "value": "307b8e86a69d15289b31259040354bc9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632210851, "uuid": "e8085523-f8f6-4e7f-b14c-ad7d41ed0290", "comment": "Malware payload (AgentTesla)", "value": "bb1cffe4e1e00e170f821016d93e03c927feb282f5cccadf201a283038a3d5a4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632210851, "uuid": "d04ceda7-10b2-4fae-a0ed-601f1fddc7f6", "comment": "Malware payload (AgentTesla)", "value": "9750e28ddbb0c53c499bfd7c01a220e3b1d96782", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632210851, "uuid": "00249f46-bd51-435c-973a-50694eec0723", "comment": "Malware payload (AgentTesla)", "value": "ed693109adeee77187af7150ba68125d32df92c4b94b661ba957b69cda48d88dbc970969e510a2c975bf7a46c5d319db", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632210851, "uuid": "86ff6512-0bab-492f-a260-129673bbf604", "value": "T13F54E01665EA73E2E0BA4FF85C21B2000779BDE61C57EF6A1E8070D94572B0162B1F9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632210851, "uuid": "6a0a0021-fdd4-42a8-ab1a-1e53edf04fd0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632210851, "uuid": "5f1c3620-035b-4aeb-8e6b-6369967b6a69", "value": "6144:vbtvJ/xaWAmwQwc0DaQhNUygR/qQx/Ck0omHURkJpfVvfKfxnA:vZFxzpwQ02QhN/w/Ck0fD9vfKfBA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632210851, "uuid": "77b77967-3fcf-4dbb-8876-ef71ef5e3946", "value": 305152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632210851, "uuid": "97b0e160-8676-44ef-9d63-6358b7e67f1d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632210851, "uuid": "87c778d7-aa81-426d-bb80-1214f57863e2", "value": "1200 cans.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae260a28-1ac1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632217969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632217969, "uuid": "2876e3b9-42fb-4a16-bd3e-c648e63c4010", "comment": "Malware payload (RedLineStealer)", "value": "6622c18788c9acec66f7d61126deb006", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632217969, "uuid": "54f29bce-77ef-4596-a117-550f3c5aa543", "comment": "Malware payload (RedLineStealer)", "value": "bb3f24a3e0fa7b765468ffd3ada047a23212200dd166e66df7a36075ad0dd2f2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632217969, "uuid": "b28dd51a-8c77-477d-abea-f5ea4984c6ec", "comment": "Malware payload (RedLineStealer)", "value": "3c2130f970f2a55ebe4b2a68672d1f5005c3988e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632217969, "uuid": "617c4b98-620e-4785-97e1-cdd282085b56", "comment": "Malware payload (RedLineStealer)", "value": "730f140c8fd9936048fc342d67ee97ac045eebd68c0cb4b84ee25d643c9140adabaf50919eee2a43e49c3c5fef6656f2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632217969, "uuid": "c40f9250-066f-4068-8bab-6b5681fc01b2", "value": "T194C5012216A97248FAAF0F729B7672B11932FD5A6960C13D4073B37D48387C16E4276F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632217969, "uuid": "4ad6c7da-8e50-491a-9f7a-e274c53c66cc", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632217969, "uuid": "aca8b135-30a9-45c9-ae9e-ed4b308eafe6", "value": "49152:OQ113U/PEz15ke9vB0OaqfP+RYSWFBlzOXW8/VI6rcy:O9O1ue6+P+RdWFBVOZ/Vhcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632217969, "uuid": "51ec18b1-b886-405a-aec1-2ac3ad75e9a0", "value": 2514320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632217969, "uuid": "ba2b7f2a-c2eb-4888-a4d3-dbd024bbc047", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632217969, "uuid": "4d261d63-fd33-4713-b1b1-84d48278c40d", "value": "6622c18788c9acec66f7d61126deb006", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ab8f3c9-1aba-11ec-8fa1-42010a9c0011", "comment": "Malware payload (BitRAT)", "timestamp": 1632214796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632214796, "uuid": "2bdd3bff-3f73-4f8c-86f3-fcf56ed5fa36", "comment": "Malware payload (BitRAT)", "value": "e7c0b56dd1a23c604dfef02fde250715", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632214796, "uuid": "029136f2-8a68-491d-b594-b88177499f43", "comment": "Malware payload (BitRAT)", "value": "bb534b16e60c7e9dac99750bb42d8c7c033c94c39bc59ce818266b6ba8f8752a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632214796, "uuid": "025b3632-6f23-40ac-bf99-38bee3de6b13", "comment": "Malware payload (BitRAT)", "value": "8fdbf63113c549be2b02913fa652f5c34c7fdd99", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632214796, "uuid": "6ba17652-15fe-4b83-bab3-7710d0e623c5", "comment": "Malware payload (BitRAT)", "value": "04d571371f816a90f9e83a75fad4bf7a7417b239d08eebcf5c63a963b1535840400240310800d8216d62c9c26348481b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632214796, "uuid": "46b8f50a-a73e-45a0-8c37-6eebe403ef27", "value": "T111852220BB84D03BE1E766F45579C3A9A52E7E705B3C50CBE2D02BDE46286F4AC30657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632214796, "uuid": "e99a7fb2-7b5a-4a67-a8f2-f316043ecafa", "value": "3c935a80613bb38675ee523829e64ef7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632214796, "uuid": "72ac30b9-697e-481e-ac67-d1edc71e7674", "value": "24576:9uLJS4WdZRCVaK3qjJwIcjIjPwmro30z9jaj/W/GGR/M+oNsW87C7QH/VDOBh7:9uPKRiGJbcjuwMoEtGGlMBNFi1H/J0h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632214796, "uuid": "128c589e-0310-46d9-ad19-6eb9e343773e", "value": 1722880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632214796, "uuid": "aa58eaa4-4870-4068-bccb-b0f641458962", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632214796, "uuid": "22c3bde2-47fd-453e-8bde-0334bf849d97", "value": "e7c0b56dd1a23c604dfef02fde250715", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fee42f92-1ab5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632212950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212950, "uuid": "c4f3fc99-d29d-418d-b22b-3eb2ce17d314", "comment": "Malware payload (Dridex)", "value": "dc77ee72271070602a8768c63775c16a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212950, "uuid": "75aa09a0-3317-4275-8e9e-e1c3ebe936e5", "comment": "Malware payload (Dridex)", "value": "bcdf06a643e9d5ed116bc0090538aa5302b9a775f25c2ed0c625cee475ee8c44", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212950, "uuid": "07e0d928-a876-4b77-be48-d60e17800843", "comment": "Malware payload (Dridex)", "value": "0c9a84e873e62b730f9ff9ed8a70144ced866430", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212950, "uuid": "071ee12a-5c8e-4b4c-8a1c-9daa9f12f7df", "comment": "Malware payload (Dridex)", "value": "84305abdd1240795bd2c91ec08f7a4d78d15104411a258369149e6202dcfb635f3d1fb702a735dcdf59e18109c00c3d4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212950, "uuid": "6dc864a2-4893-4950-9237-2a8b976ee10e", "value": "T1FDB5D010EE69E1E6C6B89F3ED408352727F93D75110D608CC392604F9EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212950, "uuid": "29a082aa-69db-46a3-a66e-345c3e61a734", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212950, "uuid": "d70d5ea1-efe7-449d-b57b-85bd2f0b1205", "value": "12288:iVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:/fP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632212950, "uuid": "b454ef3f-06c7-4b95-9009-16b310ed29eb", "value": 2404352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632212950, "uuid": "21e42e81-38a7-4804-905a-1f7b4ca4bb60", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212950, "uuid": "dd08da02-171e-41c0-84f5-f46bcb187837", "value": "bcdf06a643e9d5ed116bc0090538aa5302b9a775f25c2ed0c625cee475ee8c44", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39974a59-1ae0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632231088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231088, "uuid": "bc0d1248-ea49-47ba-b028-d92a296374c7", "comment": "Malware payload (RedLineStealer)", "value": "e179e4a90d69dbbd7e16fc5c880ae534", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231088, "uuid": "2590bb9d-f09e-4364-a8f1-8f29aa9c2c3c", "comment": "Malware payload (RedLineStealer)", "value": "bcfaabe847b4b231c0bfb5ce7e50a95e580c3dbe6e4089369a9a35ccd6867372", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231088, "uuid": "33a88fe1-2523-4de9-8220-e1f4773c8644", "comment": "Malware payload (RedLineStealer)", "value": "e02a8274b4ef35d358dede498afdd334b7aa66ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231088, "uuid": "4104d815-547a-4347-8242-ef57903caaa3", "comment": "Malware payload (RedLineStealer)", "value": "1cd59bd348f341dd1e0bcc2e75466b60408e397800f72d39a1916f7ecaccf2fe02ba10925fe653be4d7100412afd81be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231088, "uuid": "113f800d-fbc3-44c1-8c65-06e01b09a037", "value": "T173E5FB7C1EC7A29FC2B789B5E5878B897E34A25348706AFDC5D73432F9A5F910881B40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231088, "uuid": "d353d93c-2cca-4c0f-b812-4e465ab1fc5e", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231088, "uuid": "e0fbb769-f0db-4658-8f5a-172a65accc59", "value": "49152:CWkOD1KaE5kcZWIPhcvZso4vkUyXGJh52KSUcxP:CWkODHcZVyJUn5axP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632231088, "uuid": "e45923e9-7206-4e2e-b52e-69ca341f3dba", "value": 3243272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632231088, "uuid": "9f2acf97-acb2-42fd-8a8e-ff790647dcce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231088, "uuid": "b15ec79b-f652-4966-a3a3-68bb53b409ce", "value": "e179e4a90d69dbbd7e16fc5c880ae534.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e230628d-1ab1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632211184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632211184, "uuid": "bc1cc559-ec5a-4817-a910-4b57858d9ca9", "comment": "Malware payload (AgentTesla)", "value": "ce7f0544c23787426b0ad9e0466409f6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632211184, "uuid": "3c4ab5c9-51e4-4b22-85c9-ab55b1e1f675", "comment": "Malware payload (AgentTesla)", "value": "bd21712de9367c6fb0d4c10cca89e13738272b0b733dd14f316185858eda2d28", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632211184, "uuid": "4eebcde1-379d-4c5c-97e1-4afdd5cf0ded", "comment": "Malware payload (AgentTesla)", "value": "e1c4234dd3b4ea48d167ea11a3664b4029bc09b7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632211184, "uuid": "72f68c56-c8e0-493c-aca3-22dfbda12fe4", "comment": "Malware payload (AgentTesla)", "value": "279ed319f60c05b48d3459e2cbc34ea0b6f76ce874b72bc13b33c22ab387e2adeb804cb88d5dc819d6b0a32e5017bcc5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632211184, "uuid": "59f2e56b-00b0-4372-a633-e49cf874a207", "value": "T115157C394D2682F787EEC66CD08C1BCEDEA6A4837B919F1AD496D7C2025770FE48845C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632211184, "uuid": "3e4e2f35-0ffd-4182-b023-5abf97d62847", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632211184, "uuid": "b4f4a212-04b8-4f8d-b3f4-d875e73ab739", "value": "12288:4LV0D4fh4m6GCom892+ob0ALD6Bvav9xFy:YHum6vZBb0AL9vz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632211184, "uuid": "d490b6f4-f553-47bd-ac9d-778ddcb1c850", "value": 913408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632211184, "uuid": "ad652831-1cc9-443e-8334-989994bb8ca7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632211184, "uuid": "2c1f9c4d-5052-4b39-8690-30e1af3779f9", "value": "DHL AWB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da552ec8-1ab6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1632213319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213319, "uuid": "482f8994-876f-46d7-8d19-046a4320caa7", "comment": "Malware payload (AsyncRAT)", "value": "7ec4754fe31abf447d87c258d8c0950a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213319, "uuid": "bcc1128e-99dd-485a-b92d-545533000626", "comment": "Malware payload (AsyncRAT)", "value": "bd2e15057b3ab40f2945a60069708d6b3bc799a7ad2567639dd4a66046419d94", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213319, "uuid": "089f1fc3-ad23-47ab-bedf-9019029a1ec1", "comment": "Malware payload (AsyncRAT)", "value": "1fbdbdf04bbeb5550479f8c787850dc358691a0a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213319, "uuid": "47f7708f-a6a9-4daa-ac66-f20ca5926050", "comment": "Malware payload (AsyncRAT)", "value": "8922bc205c285221dea7f82bdc3133f85082b36a369a29f2c19aef86496308fc80ad3d7b64fb07715cae10f35aebc549", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213319, "uuid": "09576ca5-0e9f-4a94-bef5-77c091ae15e4", "value": "T19534F7D0ED449581E825FDF2C16BAB6842AA6CE5BDC1CEC240B6B1B11631A47FD0A53F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213319, "uuid": "ef3595f4-893a-484f-90b3-036d136ce9cb", "value": "d91f8fa7ff706b07bdf3a0948f972a09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213319, "uuid": "7107bb8e-1eca-4f77-8438-cafdbb2d16c0", "value": "3072:omcZcOUmoz93z8aKDe8hNau7XcgSZdY1wtRXp12a:omuKD1ue8hNauXbutxGa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632213319, "uuid": "ecaeee98-7da8-477f-aabb-4762d9a1093e", "value": 244736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632213319, "uuid": "628170d1-aa49-49e9-909b-14ed4b13da58", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213319, "uuid": "2e89e27a-b28e-4a7c-a41f-508bd6bc73e2", "value": "bd2e15057b3ab40f2945a60069708d6b3bc799a7ad2567639dd4a66046419d94", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2759686b-1ad5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1632226333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632226333, "uuid": "ef0d4684-e9e3-47d9-b575-fc547d964dc7", "comment": "Malware payload (AveMariaRAT)", "value": "0c86f823d63e750525e5cce0ecc087ff", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632226333, "uuid": "2ac656ed-d8ca-44b1-a599-4186ee9febbe", "comment": "Malware payload (AveMariaRAT)", "value": "bd47342e4916289cdab05ec453d284432add03e4bbe2fc9da584103369f9cbc9", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632226333, "uuid": "435946da-d571-49f6-a5cf-daad5d0fb051", "comment": "Malware payload (AveMariaRAT)", "value": "a98e8a8d29b3e04121995f927f26f0421ecf7eb2", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632226333, "uuid": "d80f8483-168b-48ce-9fff-49279d3c13ee", "comment": "Malware payload (AveMariaRAT)", "value": "1246ad2c37d2a6e86987b47518f3d8e763ae3de3dfd4b244856fbcd9a4c918c9629bb2f1ae7adf5157732930937b985f", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632226333, "uuid": "2e16713d-df17-4606-b46a-53b92d5b5561", "value": "T1AE356CC37740ECF6EC25397ED84571566211ABF63C039D0D9DB47ACB2AE9A50B88C893", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632226333, "uuid": "8d62b78f-2b52-4d03-b002-edc8e6149604", "value": "bc8cc1eea5c25ce2056d7da92bd98134", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632226333, "uuid": "2d72885f-2a5a-4da0-ac93-be63ed8bd5a7", "value": "12288:BSZPsJUL/MN/cen/VwTQBXcameDCnNm4eoAdrL7+o:bOQN/cu/VdBXKyCnE7rP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632226333, "uuid": "8edd44df-6657-4f12-af22-942125819168", "value": 1080320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632226333, "uuid": "0a2cc4b2-1ec8-4742-a02a-80a22a5a2cb4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632226333, "uuid": "7ef1d5ae-c986-475c-9e5c-56148c336e2c", "value": "https___cutting-tools.in_image.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce206cd6-1b11-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1632252382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632252382, "uuid": "912461de-9a92-4e70-ad4d-003b17d6bac9", "comment": "Malware payload (ArkeiStealer)", "value": "8e297c458bdd0f4f8081a872746c8b03", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632252382, "uuid": "a8da4399-7411-465d-a3e0-ce045253ddfd", "comment": "Malware payload (ArkeiStealer)", "value": "bd530072919bc000889d2f5408d012148a224bb741e5ad6809b2442622904e3d", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632252382, "uuid": "c19dd769-c3bd-4a33-b00b-a3fe93f3211b", "comment": "Malware payload (ArkeiStealer)", "value": "1d989123e5ce49835d424f52ba6336cc865ff276", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632252382, "uuid": "9cf18437-bdf5-4e91-b210-ba09a7b4be4f", "comment": "Malware payload (ArkeiStealer)", "value": "856ce191fb6bc0fd4c78cb8b271c6d57d1b3f856ac72bebb36389788f935489c103318fa36908d4c71a73275e280145d", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632252382, "uuid": "963c72aa-91ef-44f2-af8d-f1a3ae3773b4", "value": "T1A0E4120175D2CB38C0BF223847A1D7A06B7BB52259604B4B6B5727ACEF393C13B96395", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632252382, "uuid": "02e18b02-a135-432e-a347-abe9d5bfd942", "value": "98349bc8fa025f57a9d49df3092c15be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632252382, "uuid": "e395233f-f7bf-4a62-82ba-4efc16a98b90", "value": "12288:q+5HuHBLri3uBkdpjYnJkqtNYgYLchHnJlZG673pA1vxrgBai:qGHWBLrieWb8nJkqcIZJ7G53gh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632252382, "uuid": "2e33212d-9e20-4125-82b0-466f4f2e3f6b", "value": 674304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632252382, "uuid": "77595b3e-fd37-4d48-9f6a-39c7354b04cf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632252382, "uuid": "5a89954a-7d56-4e37-b904-2dce0d93c1ca", "value": "8e297c458bdd0f4f8081a872746c8b03.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4c1a55e-1ab2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NetWire)", "timestamp": 1632211511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632211511, "uuid": "6f74e984-f861-471f-96a7-4f6ebfbe3655", "comment": "Malware payload (NetWire)", "value": "0bbccb6e1385c562f8f79a0096d4b1f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632211511, "uuid": "7873974a-feeb-40b9-96d7-d4201dd5b92a", "comment": "Malware payload (NetWire)", "value": "be2073e4f262c4e72167e22c77958fa4e7b4fb08c63c213e2cfdd5b9a3b30f50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632211511, "uuid": "be514cd1-8647-4c24-9f11-9d37aded4c97", "comment": "Malware payload (NetWire)", "value": "d488fa350b1f3d9deceaac9209a74782f250876b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632211511, "uuid": "3c484b4f-298f-4174-93f1-7ffe4ab4528c", "comment": "Malware payload (NetWire)", "value": "ae452d621dea873aea8f4ced98bb5015f2a8d4b868913fbcb1b2de12c3f6c65e3cfd7efe4697c69325baf83e6acbbdb2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632211511, "uuid": "9bb1251a-d16e-4408-96b0-59ee4d0c1d46", "value": "T18BC4015171AE4268CB9E3B72206197903B73FC769973920D2ACC70CD5B376428F76B26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632211511, "uuid": "22577ea2-48af-4c93-bd44-6cc7d4aee50a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632211511, "uuid": "2d242bd1-39bf-4348-b4c0-9f2ff83621a0", "value": "12288:jFpLIbw8eGGmtiK5okiDgHPEcJTwZdwDF:r8bw8eGG+FopcsAcZdi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632211511, "uuid": "2b412901-e547-44c0-8eae-056e5ad37f75", "value": 590336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632211511, "uuid": "96fcb80e-0000-4842-9747-e0026f6ee42a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632211511, "uuid": "e5a0e148-b1c6-4edf-8561-11989e1fb865", "value": "HT0536CF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "374c4023-1b15-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1632253847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632253847, "uuid": "3c9f9c45-088e-4b7b-bb58-87a89dc28ee2", "comment": "Malware payload (AsyncRAT)", "value": "12426a177ac6861b627c258e0970c914", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632253847, "uuid": "fc6bdc1c-e161-4d5f-adde-587b2cc28cd9", "comment": "Malware payload (AsyncRAT)", "value": "be828692569f079f2d0be2c22d4f5cb817373b111a70232908d8787417c3fbf2", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632253847, "uuid": "f94fb1fe-06c6-4914-9090-e553e25e76c8", "comment": "Malware payload (AsyncRAT)", "value": "a579987d242ca196492882a940192dbbcc39f0bc", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632253847, "uuid": "cca0806c-7d90-4574-9312-32c21b67ba9a", "comment": "Malware payload (AsyncRAT)", "value": "740384ba162e5b903870abd8e31fbdc18561fe51d80ee686b3233cd5a633ea7ef666fb8473742f7cc10acb936567b6c4", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632253847, "uuid": "87134dda-e6d1-45c1-9e02-d13859db509f", "value": "T154B3FDA586FC5D47EA9FF37894242C1382CE5E7150C2C19A1B99BC7AF3FAA9780141D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632253847, "uuid": "e3f7eb1c-c776-4cc8-97c7-2d9d9b7f887a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632253847, "uuid": "600cead5-2479-45c7-8b7e-fba42a1d4b8a", "value": "1536:ooflYzjJ51cr1ysImLy3bhXSbnN1YVtlIBFMUHTvNx:ooflejrlmLy3bhQYVtKByUzlx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632253847, "uuid": "15125681-1592-4dad-a15f-b1ff4df10bf3", "value": 113664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632253847, "uuid": "a42d6790-cc16-4b3e-81e1-c547a5e399d5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632253847, "uuid": "7d7bd74d-9996-4d25-9c31-8a09b93cd329", "value": "12426a177ac6861b627c258e0970c914.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c26f1499-1aec-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632236471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632236471, "uuid": "490dfd34-d13f-4cde-9759-3cf521e23c97", "comment": "Malware payload", "value": "d54b9050786e76881f86edb1df85a5f9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632236471, "uuid": "cfb46f0f-7d61-412f-9c52-ab59687d30cb", "comment": "Malware payload", "value": "beb2a2af37f9b83e3bbc1a471e05c44d42978af03d2149b51513ce54ac67524a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632236471, "uuid": "87e40e9b-7adc-4e49-90ea-0e0078637794", "comment": "Malware payload", "value": "e505dd4cbb8e97224d2be54f8f5b8bb25a32dae5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632236471, "uuid": "9997a789-a033-4d64-b496-5e76ae32dda0", "comment": "Malware payload", "value": "cc77884c9ce6e15181c300863d688799685fc82abbe7c53614366247262f0066415a4c12d05a83ed923ead265d1b11ad", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632236471, "uuid": "711529a0-2c44-49ba-90ca-a542d062c7fc", "value": "T16F33F2D78745129CF032CC7BBD1F5AA1B17522319CFA3671513AE7A879C1182E7F80AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632236471, "uuid": "0f1ffc49-c380-4f6c-b6f1-c1d8991523ac", "value": "1536:9W6RbOqJG+Y1W/YEEy/M2qGL+AbV1VIQckP5OX11vY7Ssd3:UE9ioQAXqY7VDbe2bd3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632236471, "uuid": "7bb25d6c-27e2-4946-a220-75fd3e8a741f", "value": 54680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632236471, "uuid": "452c88e8-67bc-4d93-8e84-14ab2c4a65ab", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632236471, "uuid": "8dda09ff-566a-4792-ab50-8b02d8b7724b", "value": "d54b9050786e76881f86edb1df85a5f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a55e8b4d-1ae6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632233846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632233846, "uuid": "69b458ae-092d-46c6-8489-5c44eab71b12", "comment": "Malware payload (AgentTesla)", "value": "1a1db4e2e92cfb5334cbcd627d8394a7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632233846, "uuid": "3e1c6b13-ce7d-484d-92b5-0ca1e578683f", "comment": "Malware payload (AgentTesla)", "value": "bfa85c9b2237a1ed4b34811803e878096cfa639b22e7c29b4c407733bcc3996a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632233846, "uuid": "3f1c66a2-9f7a-417d-99fd-c9b4b3c1f373", "comment": "Malware payload (AgentTesla)", "value": "3b357e229f364a4ceca8cd743e9c433994e9d402", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632233846, "uuid": "a63ea0d5-4cad-4db6-8b8a-642529247cd4", "comment": "Malware payload (AgentTesla)", "value": "3e30c810a5062a22e94b6112cff400a71dfea754d0eedaa4070bce56fe762d24078f96675a2b58d6c5b6ededa3fb5095", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632233846, "uuid": "4b66c409-6bb4-4ee0-8cae-03d5302225d9", "value": "T1F16513C9BEF5ABE5D0478FB1031D00852759FEA6DF23DF359218372AB235A6815C3928", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632233846, "uuid": "b446c823-0707-4529-8f29-aebbc435ae35", "value": "24576:ujMVcvdtlr9hTcZnHNtd6BVtoZjoxVbKL3vokAfwVjBQ/9aHgIWslJbm/g+lSR:/KvxphTKToV0jo6L/okAfwoFaHgIWoJ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632233846, "uuid": "3543d2f4-e5c5-45fd-a4ae-0a2092da89a4", "value": 1436872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632233846, "uuid": "db3ace27-647b-405c-afb2-071249d7e8fc", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632233846, "uuid": "a5e531dc-4cac-4b7b-a951-1d895c72d789", "value": "SteelTrading-PO41620.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c1edbd2-1ae4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632232891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632232891, "uuid": "5f21dbc6-f2e4-40c0-9703-1d10983d0b07", "comment": "Malware payload (AgentTesla)", "value": "4697a8257fa5124402f540825776f28f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632232891, "uuid": "e04d5c51-de2e-47a1-90c3-6f029b5c7f9d", "comment": "Malware payload (AgentTesla)", "value": "c1da7eae31d1f636b76415075e9a14d791b9674ccd338f5ad2cd3a9f56f0341d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632232891, "uuid": "d3b11c6e-b3f7-4d50-8c1b-bc9dd1534668", "comment": "Malware payload (AgentTesla)", "value": "d3eb9e2e83fba3c8a221c9d2c15646d1b3fa7342", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632232891, "uuid": "66718e4c-49fc-4101-8865-b4aa092f7d6f", "comment": "Malware payload (AgentTesla)", "value": "e34d3e4d7ef29a231a6f68f58132c3e67048be786ab83cdb324d6173e393d3d979c25e6c7f5ef55697356af11121be1c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632232891, "uuid": "ca3248d0-7630-4742-ae2b-6b2c6e5b74db", "value": "T1DBD40182B29D8255DB9E3B7531A583903FB3BE766833D60E25CD708D4BB72458E70722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632232891, "uuid": "43982b19-79c3-42a6-a889-eac6747b2112", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632232891, "uuid": "6499bf87-c0ec-4062-abae-683bae892cb7", "value": "12288:HeIbw8eGGmtiK5oD1LMkZl3cbuqVxg1mRPrcUzsPkSjUZLw+:hbw8eGG+FoD1YIcbuKoGrcpPljUZLP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632232891, "uuid": "0991aac2-30eb-407d-aa98-a1fc71e76348", "value": 649728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632232891, "uuid": "125630f1-dfc9-421e-971c-cfbbecfb39f5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632232891, "uuid": "3e675594-a8be-4604-bfed-24d3421b475f", "value": "Facturas Pagadas al Vencimiento.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ce8ed55-1aa5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632205753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632205753, "uuid": "a85d0606-54be-4eff-accf-ffc63c904256", "comment": "Malware payload (AgentTesla)", "value": "16aae59f95a252ff782ca203a3f5b16c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632205753, "uuid": "a3000517-6380-473e-9322-14271b8f8de6", "comment": "Malware payload (AgentTesla)", "value": "c1f5b077bfd34cafcb3bb09361463329ef58c3692f13fcc6d2ffe01b55d734e2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632205753, "uuid": "5a20f9e4-132b-4e0f-a4e5-692923ed39fc", "comment": "Malware payload (AgentTesla)", "value": "c30babc9a258a4982e1b074343bc98d6b10d7f0d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632205753, "uuid": "3e63ced4-b5fc-4e4f-a601-b82eaa6e28b5", "comment": "Malware payload (AgentTesla)", "value": "ffee85be83bf58549e4b67c217d3aec46246aebc5f28081835ffa05f4781e8731bf7156b13160188c661767098212987", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632205753, "uuid": "c6013c8d-87ac-4c38-8213-b10d65b1cfde", "value": "T14884BE326307BDA7DB760EBBA1202D000CE72A5F477446D8798935CF90A7350AB9D9E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632205753, "uuid": "8b41f6f2-fc34-490b-af44-ab708942d944", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632205753, "uuid": "25213318-bee5-4954-a265-1542b284a038", "value": "6144:uJZ615GHWWjHn1N6yOFfbK4eIeqN6q/SdWXu633t0E3u1DbinfCWTEmdEFsmiAaa:uUWTnK6I+63BUDbif7TEXOXAabs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632205753, "uuid": "91039133-0132-46db-a2af-a08d2982a9d7", "value": 387584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632205753, "uuid": "533e1bf4-fd2a-4718-8d04-256eb30ae2c7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632205753, "uuid": "eebe44d0-904a-40c2-9850-9421471d1e10", "value": "DHL STATEMENT OF ACCOUNT - 3300315209_PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44e0da70-1a93-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1632198035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632198035, "uuid": "408133ce-5a18-4291-95a4-ac47240c4cd4", "comment": "Malware payload (Loki)", "value": "f0074cc335d44cbda666781d065c504e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632198035, "uuid": "6971f421-4c0e-44b5-b99e-43fae8caf284", "comment": "Malware payload (Loki)", "value": "c233d4f4d91b4caafdfaa0ddb84a9ad30436719de65f9c17eaeb8cde8663edbd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632198035, "uuid": "f4dd9e82-389a-47fb-9861-0700a6ee5e62", "comment": "Malware payload (Loki)", "value": "0e3954cdf0100ea58efe3f53d78024df5f599baf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632198035, "uuid": "547a1cee-541f-41cc-ad0f-6a5976cff497", "comment": "Malware payload (Loki)", "value": "9cc5212ba0abefcb25c1f3de895080c518cf21652d884e4a010f89fbdaf224427507828c1f11df99d9c67fc99c04f7df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632198035, "uuid": "22f0e6b6-885c-46fc-88af-089cb8341fda", "value": "T18B34121671D664BBE27376B0097AF324F27BE0581011EA4BCFBCAF2217E4945A6193D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632198035, "uuid": "02e066b6-c50a-45e1-9ac7-d20c2fecdf88", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632198035, "uuid": "6d0d9848-fbcb-459c-9ee3-0d514b0b2ccd", "value": "6144:Z8LxB7So7nZsM80kbhUFrty4SldEXKrfwl9uKjiTFL:AFnzkbhyk0XKU/uKju", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632198035, "uuid": "e4fc1ac2-a24c-447f-b3ce-a7337685ca00", "value": 252517, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632198035, "uuid": "fba7d15c-6dd0-48ae-a585-15f0b72b22a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632198035, "uuid": "99dce0d6-9415-425c-ba7b-e86bfd9e379d", "value": "TT COPY_002109.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32cb5f20-1ab6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632213038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213038, "uuid": "135493f0-0703-4369-a4bf-45b3fb63cfbd", "comment": "Malware payload (Dridex)", "value": "fddc63d09b6b1ecbc0a945ab4c11817d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213038, "uuid": "2f0802f0-c958-44f2-ae89-3dfd0fe431ea", "comment": "Malware payload (Dridex)", "value": "c25257d7596a9605599238ab8df2095edb979c18a4f3ce2cbb3a0971d3f19f04", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213038, "uuid": "defcf32c-db2d-4520-bd78-fa28427a9d8c", "comment": "Malware payload (Dridex)", "value": "3a96e41ac70512261d38feaf1c062758c6039081", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213038, "uuid": "30e940bd-7387-4a7e-94fc-c168f090f910", "comment": "Malware payload (Dridex)", "value": "def614454d19d7f06ae21e38aa9101f5c3c24ae076c4c2b30e1702be69e6c9f763e1592783a8abec0fdee5f385b7e639", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213038, "uuid": "c4555434-615b-42e8-853a-7cf3292f9743", "value": "T129A5E020EE69E1E6C6B89F3E9408352727F93D75110D608CC392604F5EFC6546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213038, "uuid": "9b78833e-246e-4c82-b212-4f673d81dbb8", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213038, "uuid": "3e86676b-545b-4b0a-b911-54138d8eef50", "value": "12288:QVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:VfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632213038, "uuid": "53debd87-881b-4a78-be71-5df6678f0102", "value": 2170880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632213038, "uuid": "8c37fdaf-d8bc-404d-ac67-4c245dfaf30c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213038, "uuid": "2d9572bf-7342-484b-ba80-d2b2931b08bd", "value": "c25257d7596a9605599238ab8df2095edb979c18a4f3ce2cbb3a0971d3f19f04", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a55cb071-1b11-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632252314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632252314, "uuid": "7dbb2b39-905b-4f4d-a7af-35ae35834865", "comment": "Malware payload (AgentTesla)", "value": "d8df42168344da59b56a583991be0ac4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632252314, "uuid": "78623ab3-8e8e-490d-a874-d8b4ed9b979d", "comment": "Malware payload (AgentTesla)", "value": "c2fd119078931fcec24c044573a7ffada54095ef9b8fa76760228c3960bf3e97", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632252314, "uuid": "ac176979-fb6d-41fa-a21f-d546deb2e094", "comment": "Malware payload (AgentTesla)", "value": "83e9a0aafbb883d804ca90d1f7e9efdb99e80c64", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632252314, "uuid": "e10d2fcb-d63f-40e2-8b40-3edee4974b64", "comment": "Malware payload (AgentTesla)", "value": "4bf8a61853c0db56d9070f9541cbdeb1644a03b13c112dec93bb727102e726ef1e6a44d267d145e558e94a08e07072aa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632252314, "uuid": "3d46c149-123f-4f8d-94a9-b997919503d7", "value": "T1A5E48D0153D04604ED3E6B34267442556BB679C66EB2DB2D8AE060E53F33702BF4B7EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632252314, "uuid": "d305ac53-93f8-4ab1-9715-4fd90d808aab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632252314, "uuid": "e5a0d475-7553-4424-af85-de93b4fff1f7", "value": "12288:4JPJB2/xfZP7t4/4YVzC85qix1rkWMEWhMOyA:Kix9W/NzCsx1/eZx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632252314, "uuid": "c5da6d51-36f0-4e7c-a6dc-e46a6322b189", "value": 682496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632252314, "uuid": "ac7f6cb6-b577-4ae5-893c-127dbc4dcd12", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632252314, "uuid": "c67249cf-bf03-4e63-b667-fda4e36cd88f", "value": "d8df42168344da59b56a583991be0ac4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7326dc6-1ab5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DarkComet)", "timestamp": 1632212911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212911, "uuid": "989402af-9222-492d-8559-b790e3d799a3", "comment": "Malware payload (DarkComet)", "value": "f257a4e79645b6727ac8cd48c80cb3ce", "object_relation": "md5", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212911, "uuid": "cbf80092-17d5-4089-bc32-e26916dea8ab", "comment": "Malware payload (DarkComet)", "value": "c3c5bcc0cd14d6dbc073e4565edf660d9c377a83dbae49132e9e4c3b526da02d", "object_relation": "sha256", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212911, "uuid": "a9749833-06dc-44be-9f83-bf636aa47e4e", "comment": "Malware payload (DarkComet)", "value": "e4e775ea5cbca89c0f1c362066fcd0042351fdce", "object_relation": "sha1", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212911, "uuid": "047b22fb-ac3e-4590-9a70-1517dde9fa4d", "comment": "Malware payload (DarkComet)", "value": "fbeb2f8b4d2b4fa1c9a186ff33a07d4501da9b0cc02c74cfe1e7c19276e1bae4afb990db5336c5d7d014e4ce7cc3baaa", "object_relation": "sha3-384", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212911, "uuid": "a5f9a914-7a4f-4049-a9ab-c67de997d9cf", "value": "T162C53399569130F8F8513DB0AB1AF5E1BA0E34620DD838310D11DABE59B6EC1E7BB707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212911, "uuid": "4e60edb0-8e62-4b69-8dda-23aa04901dad", "value": "8fa3bfbee376a470d7a9d5794558993e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212911, "uuid": "54dc2a2d-089a-4d80-90c9-5210f2bed8e3", "value": "49152:H33Gc5sT5JnTErD26anzFTv4RQUT0PllBVvf8oCTqlNdOcEFfLDDwDq6mXw6+hCx:H3LsT5JnTk26anzFTgRQUT0vBVH8oCTh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632212911, "uuid": "cd030c40-b462-4482-81db-e26021aef274", "value": 2669568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632212911, "uuid": "a3b5b3ed-9db2-4c2e-95be-d67238e4e4a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212911, "uuid": "75a5c74e-c9a4-4242-9839-f825a0e74c8f", "value": "c3c5bcc0cd14d6dbc073e4565edf660d9c377a83dbae49132e9e4c3b526da02d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "371f39fd-1ade-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632230225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632230225, "uuid": "c7e39d96-10fe-473b-b42c-1f437edd0ae3", "comment": "Malware payload (AgentTesla)", "value": "7db1db42cf04e1bdf88dab85b3ad8c5b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632230225, "uuid": "2e25cc52-da5f-4d46-a646-089d9696b42f", "comment": "Malware payload (AgentTesla)", "value": "c3d156f7aae24d19296b03005618931aa7011046cf1858dc209015fd223419dc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632230225, "uuid": "c2354a91-485f-4b47-b33d-1e0c0df57f22", "comment": "Malware payload (AgentTesla)", "value": "8c5354fc2cd32443e107e88dfed90b8058406634", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632230225, "uuid": "38ac6dfc-4012-49a0-9a64-be9d945f97cb", "comment": "Malware payload (AgentTesla)", "value": "5bbce5e00b668635ceecd2aea903300546451712f12d1d82577301e72671c9b56b9867f607aaf1ae0fa8bb4aaca8d96a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632230225, "uuid": "0b5f4cc3-cbed-49a3-8b12-075ed8ba81c1", "value": "T12225AF394D2686F783EEC67CD04C4BCEDAA6A4837B919F1AC496D7C2429770FE48845C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632230225, "uuid": "03f22bb0-6d4d-42b1-b2c7-9cc869258625", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632230225, "uuid": "2496610e-46e0-44f6-b540-a0644f5d8acd", "value": "12288:7nx0tCVxzFWSG/jgK+0yat7ICQeQazv1F:d7Vxza/jgK+0zt0CGazv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632230225, "uuid": "4acb36da-a244-4c03-a82f-606c4b342cb7", "value": 965632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632230225, "uuid": "c920464e-7465-463e-9980-9550b5d1e45d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632230225, "uuid": "f4ad861a-f7b8-47a5-8d5f-8803033444fd", "value": "Enquiry_202188095.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd475ffe-1aeb-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1632236087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632236087, "uuid": "4f515404-f656-4593-b7b1-94d74bf2d081", "comment": "Malware payload (AsyncRAT)", "value": "1bb369267114ff38acbc81c8ba76fa05", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632236087, "uuid": "d5503fdb-b6d3-407d-bb04-8538f03de67b", "comment": "Malware payload (AsyncRAT)", "value": "c4c4305b733f2cbb4bef63dfa2dc5cf4d40b07dadcac884ff5552ca5a926ec06", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632236087, "uuid": "6278e0b7-e3d6-4186-bca6-ef7f6b715af5", "comment": "Malware payload (AsyncRAT)", "value": "b187afcb42906b48bd145fbec05faff0b6158094", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632236087, "uuid": "8e2a29af-e8f4-4b7b-a17b-c963758425a9", "comment": "Malware payload (AsyncRAT)", "value": "d8fa0c66e4a125b3529a7761b99c908c1901dcfbeb2519994f8f8669ba1dbe2a775c503f9bd9fb2419450009e516c1bc", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632236087, "uuid": "070fbbe5-2a12-416c-8201-e0f88d8ae6f1", "value": "T197A4F1A2B19E4254D39DBBB1216193407FB7FEBA5933C50D2ADD30CD4A37A814E71B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632236087, "uuid": "043a4beb-290e-4f52-b43e-1473ce7bdd07", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632236087, "uuid": "ff32f825-634c-4238-a38a-83073d622485", "value": "12288:0hIbw8eGGmtiK5oSVCa2KLpVttHiLr12:lbw8eGG+FoSVCaVLpVtJi9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632236087, "uuid": "4f326c4a-510e-4a85-b932-278ceb96466b", "value": 468480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632236087, "uuid": "85b116ee-b440-425b-8892-41d77f329489", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632236087, "uuid": "ee322a7f-36f5-4f8c-b437-bff9b06448bd", "value": "0037609INV.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8570799-1aec-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632236481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632236481, "uuid": "62bdcba9-c6b7-4058-814c-4b62dcf2f6af", "comment": "Malware payload (Mirai)", "value": "bff6460b67b972d945dcad2a3a8f991e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632236481, "uuid": "5b2f0051-8086-4262-9b7a-2eb9122f823f", "comment": "Malware payload (Mirai)", "value": "c5138fb7548e375f76570ada35255761eacfecbe7ecf19420c209d027da2c639", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632236481, "uuid": "7b0fa389-4c33-46fb-b437-61dd2ecbf1fa", "comment": "Malware payload (Mirai)", "value": "442c88f41ddfa75dcfbaad1a3e051ed130e33d90", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632236481, "uuid": "5630c043-6e76-4ae7-b88c-8bfebe589b9d", "comment": "Malware payload (Mirai)", "value": "bab06f619c94d147ebf207565d21873b2429bf749a7983ed7aa7dc754abebf3f67f265e98587c857b307b6ac0fcb15b5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632236481, "uuid": "855b20f2-eb66-4881-9482-908a1dd4dba9", "value": "T1E9D30992F904DFB6F04BA33508D30B15A770BFA14B825536732779A3AE365D0A827F46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632236481, "uuid": "62e3fb5c-c227-4a00-8811-f7a9e6c06bec", "value": "3072:IN3rEHArLxVhKFWWKb8yOmNSayr+rlXbAjCOmqcM1JDN+iuxX:INwgHx+E74APyrolrY1mqcM1JDN+iuxX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632236481, "uuid": "6e340491-0d12-44e6-b78f-b50b7d6f7f47", "value": 142488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632236481, "uuid": "5eb1e2f3-a4cd-4d72-9526-27f4684bec31", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632236481, "uuid": "1b12276f-1f8b-4bcb-b141-5f0c49a16346", "value": "bff6460b67b972d945dcad2a3a8f991e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8596c3eb-1ae1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632231645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231645, "uuid": "853420cf-5b56-48d5-81cb-1dbb851f4d64", "comment": "Malware payload (RedLineStealer)", "value": "56360110b5eb9e8523cf04af09de319a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231645, "uuid": "566c4905-bd82-47b3-a2b7-1e66c7724713", "comment": "Malware payload (RedLineStealer)", "value": "c590ddcca494bb3d21012c0e539ad382e5e8f74350a70ed1db464f80590e1134", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231645, "uuid": "5de40f12-f8ac-4d91-bef3-de5ceb321670", "comment": "Malware payload (RedLineStealer)", "value": "e3741bc65d507c6a5f06aabb8eead38c04cc0a02", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231645, "uuid": "72da5f71-cbf3-46f7-b2c8-3cb08a896828", "comment": "Malware payload (RedLineStealer)", "value": "2a7691628e18ada8d79ca10f5a55e4309380522026c832ec8d85da52f60b2ce3bde7994cbec048dd2b5f05c9b2858282", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231645, "uuid": "559b4d59-c61c-4c1a-bac4-afe9b8310529", "value": "T14EE508D0BE1F96AFD2670078D0C3998E97562BB343184D15C9ADB5B8B9F3C0718C6A39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231645, "uuid": "e73a06fa-dfce-4f3c-a55f-b37e854e15df", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231645, "uuid": "e64effae-7bbc-40b0-a4c3-31d1e5e860fb", "value": "98304:jFfxGtvnBbvY6QneTD/yZwJt7ft3UcWwv0/Hf/t5+uN+Xh2hZ2NgHJX+IA/8agvt:JeBbvY5neTD/yZwJt7ft3UcWwv0/Hf1D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632231645, "uuid": "a731e772-2d43-4a4c-8f0e-5b47ae374e88", "value": 3246344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632231645, "uuid": "d74e6be4-1ec9-48b6-a0d4-b1510eca0b3f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231645, "uuid": "83d67418-f46f-4c6a-a2aa-f239f7d6ec00", "value": "56360110b5eb9e8523cf04af09de319a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8488a25-1b11-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1632252399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632252399, "uuid": "d4552345-a0ea-458e-959f-d1b0d8625797", "comment": "Malware payload (ArkeiStealer)", "value": "125f7520fedd20d52c55ea0eba16e1d0", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632252399, "uuid": "fbefff92-d3f0-442c-a2aa-57e06f9ac4ac", "comment": "Malware payload (ArkeiStealer)", "value": "c594709debb556c92914983099ec9d5ae29efbbf135cbc562b615d7b8a8e44d6", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632252399, "uuid": "5549fb1c-0d0c-462c-896d-bfc4ee473de5", "comment": "Malware payload (ArkeiStealer)", "value": "45a3998c239eea3bedc81fbd29f7ee5e7878eb5d", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632252399, "uuid": "1af07810-bcca-4793-b071-13260e73edc2", "comment": "Malware payload (ArkeiStealer)", "value": "a8e04337ba50795ae7f14b110feaea13ea40285eb17aa4ac882800f91ae46a8bb38b988fcb5f8d8e7d2afd6e9639fd7e", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632252399, "uuid": "b8653db3-6ab2-414c-a3f9-0504d12996f1", "value": "T1A265E125D281F033D2B3FA38DD959B7F5B387E103914180B6EE82D691B263C1B619767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632252399, "uuid": "8dc79379-efaf-4af9-a1fd-9e45be757f17", "value": "c32368f78c61cf2d9d6654d89861a9fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632252399, "uuid": "2f9ea44b-be7e-44e9-8b52-79581fbef226", "value": "24576:HBuzcdGnDDlIFX9qOZGPlhOCoNS8M7TRNF8mTWncJ4UdVpK:H2DwXxZwxiURNF8c/7de", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632252399, "uuid": "a14f6fc5-b8b6-412d-b988-301ba3b282cb", "value": 1534976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632252399, "uuid": "f6f52df1-1cf2-4ba5-b19e-fbf5ec7e53f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632252399, "uuid": "de0ec7b5-8521-4f56-b7a5-302425ad7f35", "value": "125f7520fedd20d52c55ea0eba16e1d0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b5e89a3-1ab6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632213052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213052, "uuid": "1dff22b2-474f-4306-a92b-9f957475e283", "comment": "Malware payload (Dridex)", "value": "ab8c28a4ca599689c4ea3a050f588ece", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213052, "uuid": "58e0505b-0be5-4020-ae96-001f18df50cf", "comment": "Malware payload (Dridex)", "value": "c5cda7817ced9406926b567f009b5740bf17e7d9a348033f1abcbc91254b4955", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213052, "uuid": "6a6af8e8-b5ef-491b-93c3-90b45d798d10", "comment": "Malware payload (Dridex)", "value": "bf22953da32b328cd19cb77f77beb4c0cd43c06c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213052, "uuid": "8ec30d6b-4f69-4c87-90fa-8481179e551a", "comment": "Malware payload (Dridex)", "value": "632b1ea795921529c1572f6c8756f5788c3058ba7f0422c5225e123f48b044ca1911db1c62403034079ee7bbdc5d9e1e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213052, "uuid": "5d4692b2-fdb7-441a-a901-ebac8aa28bf0", "value": "T14AA5E020EE69E1E6C6B89F3E9408352717B93D75110D608CC392704F9EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213052, "uuid": "83ce772a-f09d-4ba6-b4b7-7a5d3a3f3afc", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213052, "uuid": "86d6f460-6b39-41cd-9286-9eaf9cef7fa6", "value": "12288:jVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:yfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632213052, "uuid": "fa018593-bd59-4507-80e3-f26bfa5f96b1", "value": 2138112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632213052, "uuid": "8b4b8fc5-4d38-4df7-a195-b7040d43d072", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213052, "uuid": "ef8b6356-6144-4d66-85a0-2baa972fcff0", "value": "c5cda7817ced9406926b567f009b5740bf17e7d9a348033f1abcbc91254b4955", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4eabb0b-1aa4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632205525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632205525, "uuid": "b6e600fa-7a91-4acc-9988-36caaa2b9121", "comment": "Malware payload (AgentTesla)", "value": "90268aaa0ffb6f7ce5b368c941c536d2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632205525, "uuid": "65b081aa-854f-44f1-bf61-12409687eb63", "comment": "Malware payload (AgentTesla)", "value": "c77e1d4d8957bf7c6f5caf16ebaf9659c21ac6760b52afff5df413e8133a3f36", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632205525, "uuid": "b920c737-3061-4361-a973-5778a7e7f8f2", "comment": "Malware payload (AgentTesla)", "value": "74d5ad93e8f65ed73c783c83c0c582b245e4552e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632205525, "uuid": "8cecc9f3-c615-4b50-89b6-03dd092c2f4e", "comment": "Malware payload (AgentTesla)", "value": "1ef235875bcca846f03d376d6611a1ed0a82579f1fee0c46d8a2b9b27ca344f536f7c50fb0d5a3dcdf384f72a3f4380b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632205525, "uuid": "de8e485b-5c6d-46c6-a122-1a2f88859a26", "value": "T1888423CF88DF6245B44D4F1B318C9B1035B9A740A517B70BD8A0EA58EC79847B277FA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632205525, "uuid": "3c5b4237-2ebc-4b39-b3cd-be6f384f55ad", "value": "6144:dgizzTC10g6asenkTHW/BxwzFI/d8qlPXn4uy1vLPsfub3hSe8hsT6VT:dvEpnp/BxKG+E1AzPVb3sthsAT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632205525, "uuid": "83bfd9bc-66dc-4fa4-9e65-a042f1403ed7", "value": 388342, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632205525, "uuid": "0a2d2e4f-b070-43ae-bff6-b2615180fddd", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632205525, "uuid": "6e6df7f8-bff5-488a-84be-77b4ee17d6bb", "value": "no. 4023- (BC draft for PO67282).rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88c03f27-1ab5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SakulaRAT)", "timestamp": 1632212752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212752, "uuid": "935a6554-27e7-41eb-b879-3f510f914070", "comment": "Malware payload (SakulaRAT)", "value": "32093dcd8d73371848928310bd9d4f62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SakulaRAT", "colour": "#EADB5C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212752, "uuid": "51ec5ea7-2b86-4267-b101-96fa35beb379", "comment": "Malware payload (SakulaRAT)", "value": "c80f1790b8239aef9751471f82c07a5192e384646040c409a8fbe48b8e57a2df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SakulaRAT", "colour": "#EADB5C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212752, "uuid": "f9dfc92c-b25f-4c1b-bbbf-eb1e19d2674f", "comment": "Malware payload (SakulaRAT)", "value": "d55322f487e4068e2e2f4ce7609498057aaf4c25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SakulaRAT", "colour": "#EADB5C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212752, "uuid": "0b61b590-d659-4da5-83ac-912015ebe3fe", "comment": "Malware payload (SakulaRAT)", "value": "09440052f4ded3b659f5ebba41f51cf0fa5f75b5a194650fd65c89a1814940e7ce1021240dcb8e00f10b3d35253ade24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SakulaRAT", "colour": "#EADB5C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212752, "uuid": "01b89c34-9456-48ff-a9de-81f304b9ef03", "value": "T14926A21173F90895F2F3AB30AEB181555B36BDA59EF6C62E3144428E0D76A50FE31B32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212752, "uuid": "741ae898-741d-43b6-9c64-c3cf8081c38a", "value": "539502771da573641ecc7f6497e39f8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212752, "uuid": "ead0346b-56f8-4d65-9ecf-820dedfe9ad6", "value": "24576:0+9mrnE2Zjll/6b8h3UZrgEu8CkBW+M3nXvIMfhlG144EE/f5DBMY1:0Y2ZjlkWEZw8Jk+EXvIMfP4FRaY1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632212752, "uuid": "2395b195-88bf-478f-b7cd-42ca162763dd", "value": 4694016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632212752, "uuid": "deaf8179-b309-4fae-95bf-92d96da78d5c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212752, "uuid": "eceedd8b-b5d6-48df-ad4a-b10663e929eb", "value": "c80f1790b8239aef9751471f82c07a5192e384646040c409a8fbe48b8e57a2df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "185dabfb-1ab7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Stop)", "timestamp": 1632213423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213423, "uuid": "7f89ec42-d983-4f39-bf2e-c0f1115e5efc", "comment": "Malware payload (Stop)", "value": "170b683757518766ed40481d89e6ab14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213423, "uuid": "014b9a89-f346-4b98-a5ac-9e7dc10d05e9", "comment": "Malware payload (Stop)", "value": "c83075a8214e1b1631c4090ec9bb3b98e27bedc042c972bd780b054aedbe6c26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213423, "uuid": "f2e8e207-8348-4184-bcc1-5c52607e86d2", "comment": "Malware payload (Stop)", "value": "a95fdba84733674ceb5e9424db0f0a69d50cdf9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213423, "uuid": "f1e096bd-d0f1-4423-bae8-0aec0556ad9a", "comment": "Malware payload (Stop)", "value": "11fe75ccdbfe0acf31e00dc6f28443ff9c13c5be4fd38a7d4c2be28399f77caf722acb2f1983d3e5ef23029bbe6958db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213423, "uuid": "69e8cfa7-5e5c-4a42-8262-2e75d83e9fd0", "value": "T171F4122175A0CA71D01354349360D7AC6ABAB83288549B8B7B1377BFEF703827F5526E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213423, "uuid": "b7271e7e-a700-437c-b811-d756fc9b122b", "value": "671b36eaed947d2e663f25178077764c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213423, "uuid": "076dc1d5-20f9-4870-9671-7a1d48356e2d", "value": "12288:m9ARXXVlwbtxap6uHipcdQ6UJ09/TdI7nd0n+AegkPXuZHFS8yAZeBai:m9UmdutdQ600TdI7uP/cXqHESIh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632213423, "uuid": "1e71004e-0042-4818-a9f6-2081e86ef81c", "value": 782848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632213423, "uuid": "c75ab760-099f-4ef0-8366-554b1a3220e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213423, "uuid": "072c565f-6459-45b0-bac2-24a93e8457c9", "value": "c83075a8214e1b1631c4090ec9bb3b98e27bedc042c972bd780b054aedbe6c26", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "422a94da-1ab6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632213063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213063, "uuid": "f6794600-4f15-4663-9cb9-82b9209bc295", "comment": "Malware payload (Dridex)", "value": "4a3849ed40f515fb2ed81fd6d0ea4a89", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213063, "uuid": "5afa82b4-9f8c-499b-b781-b33a635667aa", "comment": "Malware payload (Dridex)", "value": "c938ff4b4eee866b42354b0111f729dfb10f8ce45e4ad9bfcba7007d435c910c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213063, "uuid": "d0e20220-8b88-4164-90ec-9bc09c077255", "comment": "Malware payload (Dridex)", "value": "ba7b2dd9e06bba146f9cb99aaa24edf73c5de7a4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213063, "uuid": "4f322873-70b9-4bc2-9094-9bc433aff873", "comment": "Malware payload (Dridex)", "value": "f1cd1f67b52f9aa28a1d50cb1189984964e82c3322c188297b56b1c43e56c7db3111ca5e84cdaab0ac03a2b3e939ec16", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213063, "uuid": "09c3503f-96dc-4145-bcbf-3e68c1e446ad", "value": "T11EA5D010EE69E1F6C6B89F3E9408352727F93D75110D608CC392608F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213063, "uuid": "89c7a3a8-8343-467e-9089-8892738beb1a", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213063, "uuid": "891b23d2-e789-4874-8407-2a162594680c", "value": "12288:MVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:5fP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632213063, "uuid": "7ee6d074-f189-4a86-a8fd-20317d1674e3", "value": 2109440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632213063, "uuid": "a3c879da-d0ad-4017-b24e-747536656f2c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213063, "uuid": "8ae23a66-b0df-4fd6-80f0-e6ce5525266d", "value": "c938ff4b4eee866b42354b0111f729dfb10f8ce45e4ad9bfcba7007d435c910c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94b121af-1ade-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1632230382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632230382, "uuid": "424b1ff9-2aa2-441c-bcc1-50263f4427f3", "comment": "Malware payload (Loki)", "value": "6b3594005aff4dbbec29f40de853d919", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632230382, "uuid": "a3d73c3d-c987-4cc6-a368-9893a864cd65", "comment": "Malware payload (Loki)", "value": "ca6341003a3599da8a13932fbac5df22d0dae19977247dbc973a27cfd8223e17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632230382, "uuid": "1199698f-4b27-4e07-9be9-2eccc06fbd04", "comment": "Malware payload (Loki)", "value": "1fb1e5ba25376c468c8958d042a7408d8bcd2a6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632230382, "uuid": "51e8ccb7-9233-4e6c-b70c-04fe00809ae7", "comment": "Malware payload (Loki)", "value": "88f4df13c5570d39523954a4db06a4d3a74b13483bbea9c4f38fa658844fe9cce5e1cb519ec2d0c8126ee1ecd440d182", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632230382, "uuid": "faa05f58-647f-43f2-bb9f-6c1e6ede8855", "value": "T1BC94E53FF16C61B8CD8887F0E1D9682C15816E685A58C10B35FB3C1AB6B8AD383D5E57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632230382, "uuid": "1e5af309-91ff-4840-873d-72409fc15179", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632230382, "uuid": "700733be-b49f-4843-bd4a-7d0e1e24cb84", "value": "6144:s8LxBoRPhkLVC6sqXenUdpWnkHfk3/C9r7J/Mg0je13:OPCLVhsFUfX/ky0jW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632230382, "uuid": "5d7a706a-db40-4aad-a296-cce5ad732075", "value": 427578, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632230382, "uuid": "fb443574-273f-444b-98af-9a7e27df9f67", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632230382, "uuid": "8ebb6356-b6b8-4534-9b28-1e561b217136", "value": "Delivery Details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd715658-1b0f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632251495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632251495, "uuid": "5847c00d-11ea-4b16-8f77-3185cebe697b", "comment": "Malware payload (SnakeKeylogger)", "value": "1b05aef53225e90d1e036688a3f55052", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632251495, "uuid": "a5962fee-35f9-4c62-8c15-3de83634d658", "comment": "Malware payload (SnakeKeylogger)", "value": "ca902120a48485659c09e272fcd1708054502f82d4fa85a229d62ab6452abc54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632251495, "uuid": "e90f2efc-f8d7-4f9e-86c1-e799a3a2ce2c", "comment": "Malware payload (SnakeKeylogger)", "value": "a14ab1a3741a222d45145d57b770e5501918691d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632251495, "uuid": "c5d8f57e-445a-458e-8393-f5883d619492", "comment": "Malware payload (SnakeKeylogger)", "value": "1873fe53d79561ebf1ef3a40bdd2bc401049d3c1d9fc1729319ad5d84d70247ed802823c37cfc0d26941849844902cdd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632251495, "uuid": "dd0cbafa-18c7-495c-a89b-3cc4b7c3dfe4", "value": "T126A4F1893844C8DFC1ED1A715DA6F779A220AC705C885D473EBA3F2E75B134228187FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632251495, "uuid": "e4387ced-7e39-4123-9f6a-06d5b4a45448", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632251495, "uuid": "c5f732d4-877f-41fd-862f-d82409249e1f", "value": "12288:VMTy/BU/cZ9YGBbNotzu93s7MxDnnWtX3:qTyscLbmhAuiWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632251495, "uuid": "5d602ca5-c08d-4872-81f1-578231730988", "value": 477047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632251495, "uuid": "799dccb5-cff1-4fad-b3b7-1ae3e549c23f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632251495, "uuid": "f6ffdf48-ef01-4b69-a06f-c8e4d9163e37", "value": "COMTAC LISTA URGENTE ORDEN 92121,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da793665-1ac2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632218473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632218473, "uuid": "a730cf8f-935d-4217-984b-0c31d4d0b294", "comment": "Malware payload (RedLineStealer)", "value": "66fce0af5908598319a2604e7799008d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632218473, "uuid": "24a1c11f-e886-40b2-9c98-ac126e931efc", "comment": "Malware payload (RedLineStealer)", "value": "caeaa61b2a6b40b30c615dd9cb342201ce3e5035c6d1a2b4936a587099b73c21", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632218473, "uuid": "896d42ca-894e-49b7-9e2c-ad6fe40016fb", "comment": "Malware payload (RedLineStealer)", "value": "db7ef8e7f7f0b53a09ef21c815387ce8943ccfaf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632218473, "uuid": "deedc41e-980f-46c6-8f54-85ae3c8109ca", "comment": "Malware payload (RedLineStealer)", "value": "3efb4463edeed92c6f76db89320f740df712bb524c6dca264fe301e19ceb5374c6a9d372e48f3a02ae4c50161583590b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632218473, "uuid": "42218272-9cad-467b-9b66-03f30eef58ab", "value": "T1DC74AE20BAA0D035F4B706F9457593BCA93D7EB15B3050CB62DA26FE26382E49E30757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632218473, "uuid": "d877d2f0-795f-4a0d-b18a-93618ca476ed", "value": "d0a8c3f24685503ba25bd76f34c13b9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632218473, "uuid": "b448e74f-9311-45dc-9a6c-4b90e074d4bd", "value": "6144:Ss7aNqGys6zIburtqrQSpdzZ+zEuvpJf/tb3z2viWay1w/5Os76:PO4s6zcurkPpd10E+x/tbz2Ksw/5N6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632218473, "uuid": "f1e1af55-0a02-455a-bb23-3070954a4dcc", "value": 352256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632218473, "uuid": "ffb90955-6272-499f-b580-5562e6959f16", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632218473, "uuid": "422217fb-345c-472b-b910-331daf0d641a", "value": "66fce0af5908598319a2604e7799008d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d9f4380-1ab1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632210855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632210855, "uuid": "58157e4c-5ef4-45dd-b0ce-1cb58729dab7", "comment": "Malware payload (SnakeKeylogger)", "value": "9f82319aadbe11c69414e960b09db5c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632210855, "uuid": "6fe0384c-ea6e-443c-8208-c00b2aab1689", "comment": "Malware payload (SnakeKeylogger)", "value": "cbf36d0e9742632db36d3b99ffc538ebb23b9855926e180820f8be40972deb08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632210855, "uuid": "b32f6ff4-5a84-4d0e-9820-6547264123aa", "comment": "Malware payload (SnakeKeylogger)", "value": "021b378aae20eaa3518f524d430ffa535b4e48f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632210855, "uuid": "4d05174c-1f01-457c-b32f-c2b99cd3d101", "comment": "Malware payload (SnakeKeylogger)", "value": "732008a0315450c4ab76b23258d941b0781d85b5ab797f5dca5c2e9f0b0cc428c2204c2151943f4677f86a82edee255e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632210855, "uuid": "0dabebc0-dd09-49fc-ad45-0f55c45f0733", "value": "T1CAC4011232AD4658C79C7BB520A093807F77FD7A4873C64E2A8D708E0B776819E71B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632210855, "uuid": "8ce3049c-72a8-4dec-b6c7-79eafc41bd92", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632210855, "uuid": "d9f69373-042c-476d-b848-d1dfe78e3708", "value": "12288:Js5Ibw8eGGmtiK5ohkT9UYG1cpoTd+tr7yBKdl9/tFyySugD8o:Kibw8eGG+Fo6TKYLpY4MKdLtUvugD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632210855, "uuid": "2fd0a985-cee2-4316-8d4d-fee21af1f8a5", "value": 555008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632210855, "uuid": "6b0baedb-a843-469d-9511-c6372650fb78", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632210855, "uuid": "5b3d8461-1f69-451a-a54f-501b6d9c5caa", "value": "Price list..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "970541a7-1a7b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1632187865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632187865, "uuid": "3afc5381-a1f1-4bd5-aebe-9f393fa18a1a", "comment": "Malware payload (ArkeiStealer)", "value": "20ef98b994bc57c9783bca65b3c2540e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632187865, "uuid": "51af6b9f-1ee8-4ed9-a972-6e023e9ff4ff", "comment": "Malware payload (ArkeiStealer)", "value": "d0cfe54414069b464762e74a0e2c4a313e8d53a0524af9cf2c1a90582978ac9d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632187865, "uuid": "212fece0-f6f8-48b9-8cec-d0a8c933747a", "comment": "Malware payload (ArkeiStealer)", "value": "3639096f2b16eaa0293a69bc92c8b16121c87e9b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632187865, "uuid": "a696cd46-1578-469b-8d13-8eb85c9bda6f", "comment": "Malware payload (ArkeiStealer)", "value": "5b4eb169925d62421c2057e571e4faad3ab4610279288fca23d5d17eecfb789a884da4ec8313b956db70fd24327b8eb1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632187865, "uuid": "19e22c6d-1e6a-46b9-98b4-6a0b4888b00c", "value": "T139E412113690CB34CAA345304F71EBB4267BF8225961434B77477BAEEF212E17B96346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632187865, "uuid": "f3b79716-a9a0-4d14-975e-767e1ae43c96", "value": "671b36eaed947d2e663f25178077764c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632187865, "uuid": "588bdf51-dcdb-43c9-9dfc-76970ac830cb", "value": "12288:oawc4i/1RVr7G9iteYcNBhIgs6OVfe4hBlXJHumbszRAiADYBai:oax4i/1RRPYtPORe47lZwROUh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632187865, "uuid": "4fbaf278-f751-4391-931c-c4cee47b63bb", "value": 689664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632187865, "uuid": "050bf90d-3272-43b9-8f7d-08d81a451592", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632187865, "uuid": "8a7db0e6-c0c4-4913-a79c-3338248524b3", "value": "20ef98b994bc57c9783bca65b3c2540e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1766ba79-1aeb-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632235755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632235755, "uuid": "6cdcaf4f-ac2d-413b-ad50-4f3b4677ebec", "comment": "Malware payload", "value": "d6ebd912025d2774be738fa0550c216e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632235755, "uuid": "0dfdb5df-6880-4566-b01a-a7af4caf188c", "comment": "Malware payload", "value": "d1d547ac7fd7f544e9616a15c7c1d50e3f038719fbac6b5d41da71f0a717394a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632235755, "uuid": "467ca8af-a11d-460c-b1e9-5a6920e16d4f", "comment": "Malware payload", "value": "8b97558c21a63a2642b246611acb9eb8c8256028", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632235755, "uuid": "24316c3c-53c0-4857-8294-5cc38cca5197", "comment": "Malware payload", "value": "de9f4fc93a3083eb07dd548bd186a259c6294569018cf7db973c2689ceae087a57ef8515c2e56ddc218a2bb842c7c240", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632235755, "uuid": "d0355baf-2348-4548-87dd-6b94221b15ea", "value": "T10533F14607C5062AD64BC6FF248633B56F7A03BA22D1DC11E511DBE7FE70E1A4821A79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632235755, "uuid": "f7298486-747c-4ced-b3dd-3ff021d6d84c", "value": "1536:zV750ulBhE+GXX1JmI3V6pe1DfryFqcVrYztgEH4:z8ulHkHmI3VgetfG8cVrYf4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632235755, "uuid": "1f9606d0-be69-44a6-b94d-15671c8df415", "value": 50440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632235755, "uuid": "8a94222e-9b36-4c24-8560-91a376e16efe", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632235755, "uuid": "21987545-b859-4e68-aabe-fa932fe9b8f8", "value": "d6ebd912025d2774be738fa0550c216e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53444e8f-1ab6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632213092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213092, "uuid": "dbc2a671-3e22-4ed8-a8ae-71b577e12682", "comment": "Malware payload (Dridex)", "value": "ee153f1b9b8a4dd5ee0e0c1f2d2bb961", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213092, "uuid": "b3682074-d9a5-46b5-9318-49a6ae7f72ed", "comment": "Malware payload (Dridex)", "value": "d22889807714346d037cf2ad96e45642f50a2598501d888fa0c7300e56a1d337", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213092, "uuid": "88dfaac7-926b-4e5c-8aeb-c47e8fafc437", "comment": "Malware payload (Dridex)", "value": "819167d34127827bc3172a1ceab6ca862c3d2bcd", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213092, "uuid": "9aac5303-ccca-450b-b371-214895d0f2a3", "comment": "Malware payload (Dridex)", "value": "fe9fcfca583c8e13f1ab7d465efa5d0eb952bb5e7006440eee505dafcbc659038f84e559dfd66f2784783f69bf14b2a0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213092, "uuid": "f2f2e7b3-267c-4abc-b602-f752a0c6de1f", "value": "T130A5D020EE69E1E6C6B89F3E9408352727F93D75110D608CC392704F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213092, "uuid": "c7f79695-75d8-4d3d-9490-01a207dcbeaf", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213092, "uuid": "6efb2d25-7e04-420f-b6c0-5237f69ed2c5", "value": "12288:9VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:kfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632213092, "uuid": "a5fd4a64-cfed-4b6d-99bb-f021e975ad54", "value": 2093056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632213092, "uuid": "68cc4d98-b061-4dc4-8947-a16594edfb0e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213092, "uuid": "da22de3d-a88c-49e5-a77f-ce4fe6096440", "value": "d22889807714346d037cf2ad96e45642f50a2598501d888fa0c7300e56a1d337", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70328819-1ab5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632212711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212711, "uuid": "f9cbdb99-62a6-4fdc-a096-f08286d67d4f", "comment": "Malware payload (AgentTesla)", "value": "bc974af02c6fd17a7d250a3efcee978f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212711, "uuid": "fc31586a-e19e-46eb-b3e2-d059a9869fab", "comment": "Malware payload (AgentTesla)", "value": "d2edae7b3a23f599fe1796bd19036f9106f6bdfeef8874f507bf74c56353c96a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212711, "uuid": "4a2be04f-48a6-446c-904e-97f398ff79ac", "comment": "Malware payload (AgentTesla)", "value": "37091348b5274ead77adbfac370e0ae02278354a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212711, "uuid": "f65e544c-b94f-4b21-8a34-7551123d0a20", "comment": "Malware payload (AgentTesla)", "value": "3fa9d7170b90a8bc7223d923d32057074c8ec78ad969845c2c7635f3aaf98780fde74a2c166381541277f06592ab5df8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212711, "uuid": "43d8a925-488c-4c81-861b-28a0e5e02f39", "value": "T138059DD17D47D89BF0DF2AB398AFC12012656E8D9161C73D26867A2B55F3302306BE4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212711, "uuid": "f727f14f-f32d-4369-b066-fe34b2179966", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212711, "uuid": "d6581a9b-7d5a-4caf-987c-5e73b5d82c38", "value": "12288:RSsmtiK5oUZlkyC5SGfw4Z/MOuSZsXpe8uOrk4UFRmT7pGQK:/+FofyCsj48SZl8rUFIJZK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632212711, "uuid": "64f36a42-f90a-41e4-b579-7c4b83b3e21f", "value": 826368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632212711, "uuid": "d273c32d-aeef-4840-9759-eea1ce421fe8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212711, "uuid": "7e079e19-4883-415f-815f-8d696e81f2ef", "value": "bc974af02c6fd17a7d250a3efcee978f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0183e71d-1ab7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DarkComet)", "timestamp": 1632213384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213384, "uuid": "18d623d8-db26-4cd6-90f7-6f2d73804b50", "comment": "Malware payload (DarkComet)", "value": "5bfa0be4efc7ffb3b6e2cd63b78fbb5b", "object_relation": "md5", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213384, "uuid": "e78c49d7-ddcb-4c21-a3eb-84583f70e743", "comment": "Malware payload (DarkComet)", "value": "d35485fe44100a4643b22dc9ccaf443a4e98890710ee52701147e2144cf164ab", "object_relation": "sha256", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213384, "uuid": "33f0fe68-48c9-4c0a-8c68-18c87bd507e3", "comment": "Malware payload (DarkComet)", "value": "92031a89f86535db2085ed43dd8034e905169c6f", "object_relation": "sha1", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213384, "uuid": "7182d0ca-af42-40b5-8f8b-61850da1b577", "comment": "Malware payload (DarkComet)", "value": "a601d04f6aef36f4a9b5fb92a24f3e3b2151a701b685053117698f1160e34cdbb78f3e17f99685c231fecc9534da9570", "object_relation": "sha3-384", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213384, "uuid": "e49c36a3-1e2b-4ab2-a5fa-0aa530093f05", "value": "T17AE48E31F2808837D9721A788C5B92E5943E7E202E39754B76E62F4C5F396C239263D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213384, "uuid": "2c14bf3f-186d-4f8c-beaf-c6596a291f72", "value": "8033c11f8a2fdfc317e8655120579933", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213384, "uuid": "318bed7c-7dd3-4433-bcd4-350c54c9ac57", "value": "12288:y9HMeUmcufrvA3kb445UEJ2jsWiD4EvFuu4cNgZhCiZKD/XdyFD:eiBIGkbxqEcjsWiDxguehC2SA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632213384, "uuid": "efca7969-ee73-4856-a644-cd1794c4c236", "value": 674816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632213384, "uuid": "58601ebd-331f-46c7-9e31-a13e8ca08237", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213384, "uuid": "cbaa9df5-061d-4347-9f89-8af9b55dabaf", "value": "d35485fe44100a4643b22dc9ccaf443a4e98890710ee52701147e2144cf164ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22c2c814-1ab1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632210863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632210863, "uuid": "01b22582-3d53-490c-a4df-005ea9b1f3b6", "comment": "Malware payload (SnakeKeylogger)", "value": "6a9df2513b6473aff33d4a26c9822e16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632210863, "uuid": "25b8f781-e865-4fea-b3d5-959d2bd373c2", "comment": "Malware payload (SnakeKeylogger)", "value": "d3f1ab40423e3e24d2a71a7e5d5b7df4daa1c1d453cb5ece484820a52a9a48cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632210863, "uuid": "563344c5-b916-41b1-9d50-eb05f9756641", "comment": "Malware payload (SnakeKeylogger)", "value": "bf514de69f3871001adc53a663d66a7d24f4e746", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632210863, "uuid": "5d78f353-ebdb-4b62-9fe0-a6671f42c4f7", "comment": "Malware payload (SnakeKeylogger)", "value": "866cd8b4e753457ee8994db53d2e7a1d93ff3d2a720bbfb5181574f2f59f2d96d78539d72c4ba55d2c4c83dab9f1da59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632210863, "uuid": "725f2142-897e-4b1f-b58d-70c39c302da9", "value": "T1B3942886EA804584DC3D6770243E8D25961BBEFAE8B4A14E2F8DB23577F31E3147354A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632210863, "uuid": "a34797ed-163b-4fdf-91ba-daf729f77db2", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632210863, "uuid": "0967e892-64ce-4e23-9ab8-704c7c76c816", "value": "6144:A8LxB+0+uhQMP6XLdRLnVqSrfmp4Ssit3h8N9jNujcprS9xQJCX+W:Z+uhQMPy7Qp5stzicROxTX+W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632210863, "uuid": "1a89536b-c289-4a24-82e8-950f35a77a9c", "value": 412120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632210863, "uuid": "d30b867d-7e75-49e9-8919-3d1c082cb780", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632210863, "uuid": "c8768316-7742-4d45-8f54-63cb359c903e", "value": "Order Confirmation _ Urgent,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08f71971-1ab1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632210820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632210820, "uuid": "e3886e15-afcd-43c3-b219-d2fe0e09c717", "comment": "Malware payload (SnakeKeylogger)", "value": "8abc82f227eb825a3c2928e98416f583", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632210820, "uuid": "f8db1a7d-9f70-467b-9e7e-44445eef7efb", "comment": "Malware payload (SnakeKeylogger)", "value": "d3fa81aab994535d580bb5fa8968877204fdaa6efec4f097dd41762406bb6282", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632210820, "uuid": "8b3c96ef-e43d-43a0-97df-affabd8a366c", "comment": "Malware payload (SnakeKeylogger)", "value": "421055aead1e3e10cbe88d395af0d3995889401a", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632210820, "uuid": "5705cdea-0a1b-4075-b5a0-1231f1009c47", "comment": "Malware payload (SnakeKeylogger)", "value": "0938507c33311f8029fa427b2a971b6db76ad859d35313e107151f2d8e33594e2f2e9684884238392b4cb6860dca4bab", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632210820, "uuid": "e8ab5716-dd2f-4676-805f-7d8f1e0ea7c8", "value": "T149053B394D2682F787EEC66CD08C1FCEDAA6A4837B919F1AC496D7C2025770FE49845C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632210820, "uuid": "86f79cfa-e0eb-47be-b978-04a11068005d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632210820, "uuid": "8e5e7b16-d34b-41ee-bb29-940392320d52", "value": "6144:WJWTgyy5O1vp/jgo4X7He2YD+RrX/4yxJ5NlLqjMG7ENdd5R3a++:abV49p/qX7HhsQge5NlLiMG7ENddy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632210820, "uuid": "7b34b71a-ffeb-4e67-8b20-a35122cb18f5", "value": 826368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632210820, "uuid": "0e67d2ea-f8ee-4e9b-bbc2-f1e59f7ac64c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632210820, "uuid": "3a4a526b-5f0e-4058-a983-f7b47cf55232", "value": "DHL ARRIVAL NOTICE - ORIGINAL DOCUMENTS__z.txt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f33146ae-1ab5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632212931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212931, "uuid": "4aeeb631-4c9b-4199-b4b2-1e2571e2a970", "comment": "Malware payload (Dridex)", "value": "064e7f8bb0516ded6a21fbccbaf63067", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212931, "uuid": "d4047236-dfad-4f80-bebe-1717b5304804", "comment": "Malware payload (Dridex)", "value": "d3fce7dab46f43fa0e3db913922b8b8a52d71f987e7d2b41cf337a2910ca08a0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212931, "uuid": "3a5c679a-a773-436c-885b-8deff6d8cdff", "comment": "Malware payload (Dridex)", "value": "2e0e3e1264092321fc2bf224d9f5c11576c1775f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212931, "uuid": "e00c57af-e89a-47f7-992c-d94a77f6ba74", "comment": "Malware payload (Dridex)", "value": "0f22c141465006678964d9fceef187c023959ffb7f2e2053b4c781851f8b3d8935ade5d2fa461fa36cd9ad0810dca088", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212931, "uuid": "fc98a09c-4d94-48a0-b3d8-1bc65bfa6a8a", "value": "T1F2B5D020EF69E1E6C6B89F3E9408352727F93D75110D608CC392604F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212931, "uuid": "0da7664b-9416-49db-bb08-a884393fc48a", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212931, "uuid": "5276000c-8634-4888-b18c-654df53389ee", "value": "12288:DVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:SfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632212931, "uuid": "4eb70b69-1b16-42bb-9093-9ff27321c180", "value": 2437120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632212931, "uuid": "d04f0a4a-936f-4b0b-b768-62601127fc19", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212931, "uuid": "b5a41c29-999c-464b-bc67-3773b9b64fad", "value": "d3fce7dab46f43fa0e3db913922b8b8a52d71f987e7d2b41cf337a2910ca08a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "931df312-1ab6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632213199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213199, "uuid": "236c4153-6612-491d-bca3-1a9813546df4", "comment": "Malware payload (Dridex)", "value": "54df47820a71292cd3bc4f0cf0e8ff77", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213199, "uuid": "30f6d5c6-d919-4d5f-a50d-8c88ae2e3e6e", "comment": "Malware payload (Dridex)", "value": "d407a06f1888c704c2fd0db1828dc01eee720b3ba8846be693431a653f45b92c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213199, "uuid": "3efa7c51-f4f4-496a-847b-203f651fe7ac", "comment": "Malware payload (Dridex)", "value": "5039c70dbb58ef365bc8edff90e1e48560906d94", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213199, "uuid": "ff52e133-0cbb-43ff-83e5-b3400fa5cb2f", "comment": "Malware payload (Dridex)", "value": "21cddaa09ef8acfdaac1f5ca26ed9799aac5093b0b5d3d392fda510e695917c107b3dc53d5a9e7df7c39a2ffd69f1f02", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213199, "uuid": "826eafc1-949e-4cb6-99d0-fed0445bd584", "value": "T1FC65E020EE69E1E6C6B89F3ED408352727F93D75110D608CC392604F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213199, "uuid": "eaac29c3-bd53-4623-8c17-e652def53025", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213199, "uuid": "28b7e63a-7924-435e-a6de-072874754433", "value": "12288:1VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:sfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632213199, "uuid": "206a8d29-4034-433f-9a86-81a7aab6a82e", "value": 1523712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632213199, "uuid": "0581c18d-0410-41e2-b0a4-7790ab392003", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213199, "uuid": "c3a09207-2466-467d-8555-f6708f92943e", "value": "d407a06f1888c704c2fd0db1828dc01eee720b3ba8846be693431a653f45b92c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01a6353e-1adb-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632228846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632228846, "uuid": "ff00d1a7-d72e-4212-b5f7-2d256c53ca46", "comment": "Malware payload (Formbook)", "value": "fcc66b3161c33bfa2e32e9f4acb4deb6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "PRT", "colour": "#27EC70", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632228846, "uuid": "db0b5a9e-95f7-456c-a952-ebe808d88a59", "comment": "Malware payload (Formbook)", "value": "d40a2b9afeea750b13595b40267238bd811fab0caeca139c97c4ae96bde0cc9f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "PRT", "colour": "#27EC70", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632228846, "uuid": "d164d94d-d417-4206-a6fb-7c24120fd931", "comment": "Malware payload (Formbook)", "value": "f170c03ad80037f46f57ec422bc97af728bc6233", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "PRT", "colour": "#27EC70", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632228846, "uuid": "355c4765-97ca-4f8b-a250-8ccd989925cb", "comment": "Malware payload (Formbook)", "value": "512e478dc3a1fdfbac08e154af6f81c6a46176e0fcb439455571b2cb3092f28764fc3a89f8fced8584948d7761f7c90f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "PRT", "colour": "#27EC70", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632228846, "uuid": "bf7e626f-6ac8-4b40-846f-d484aff0f421", "value": "T115D41252B2DE8568CB9E7B7525B693507BB7BDB91473D10E258DB08E0B372804E34B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632228846, "uuid": "68798f6d-2a4d-4f53-87c6-3df4de107a45", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632228846, "uuid": "888f87b9-aa70-4013-8959-14a1393900ce", "value": "12288:n2Ibw8eGGmtiK5oiiXSTPKLV6XMfkMooV0O88kWsFOHN9eUSV4:Zbw8eGG+FoveAYEkMooVv/hK6N9eUSC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632228846, "uuid": "14639db8-0307-43fa-83fc-e535ea14fe40", "value": 612864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632228846, "uuid": "e5d04927-c087-42a6-adc0-2d6c55429f5b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632228846, "uuid": "cc4e81d9-836f-4fa2-9a46-86e80e835d22", "value": "Cota\u00e7\u00e3o de produto.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6edc8afa-1aa5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632205837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632205837, "uuid": "30f35597-2efd-4aa0-a8bb-3deb4889ec6d", "comment": "Malware payload (AgentTesla)", "value": "69346f1049bfff5e0c6e9c9ea39bda61", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632205837, "uuid": "c6813293-03ae-4965-8071-73c0cfc36c42", "comment": "Malware payload (AgentTesla)", "value": "d502f449e20dfad4bda71d37c5f0c6f4c5e44df76682b791f63e329188adbc04", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632205837, "uuid": "206833c7-40de-4881-ba90-e82f3115edb1", "comment": "Malware payload (AgentTesla)", "value": "4aed744d04b6de773f3c4fce1aabf6db22a1e833", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632205837, "uuid": "2dd2b367-2081-4148-ad8e-01121817c648", "comment": "Malware payload (AgentTesla)", "value": "492395dc37e84dccdac3cfadd677919371ed57874ed567980f019209488124d04a70e944c7473c6f833e9eab1ad97202", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632205837, "uuid": "983a9710-1d82-498b-8a6f-ad87a98ad301", "value": "T1E2A1076023BC159BDF4AC1B7C47DFE6206E8F5294ACB1790B62CF5B10B373616924582", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632205837, "uuid": "c5521a1d-0988-4a34-b27c-c4104782766a", "value": "96:cgu5hQuXB2XiGzMDU7ZH9hFtJoNq+Z9BtNqsypSu4nTsYI8OK3BfJjM11Hyz:AhHXwXiGzMDU1zdow0iskSu4h3pJk1+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632205837, "uuid": "e8729c83-eec0-4eb5-8981-6580a136f96c", "value": 4914, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632205837, "uuid": "48c03d36-c144-4709-8c7b-74fb0cfe6a6f", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632205837, "uuid": "189507b8-4941-447f-a4a5-3ff869cb803f", "value": "FT109171047035.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70c3175d-1ab6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632213141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213141, "uuid": "f65f2223-2bf4-4154-af14-de0576afdea9", "comment": "Malware payload (Dridex)", "value": "0eb5f42539e9c90b7e1cfde33366e4fa", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213141, "uuid": "36d55f5d-dbbb-434d-8034-5e8d7b0c033a", "comment": "Malware payload (Dridex)", "value": "d5f06f4caeda0e1b09b93132f71b63e606565c6b3f3951bc6428ed702c8cf607", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213141, "uuid": "40d24b25-4e3f-452f-b378-530320abff5d", "comment": "Malware payload (Dridex)", "value": "8cb1d9530f252b995928fa6ed71a6f72588c46e0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213141, "uuid": "42ff84e7-49c6-401a-8432-17197661a919", "comment": "Malware payload (Dridex)", "value": "63d1774b76cc0474639f402218ea9ad5c9c283175ee5c1870e699f624e5bf92df2c634d5be89dc70951c7330777dd240", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213141, "uuid": "18b41d93-bb91-4f58-8521-544b38ee74f4", "value": "T16185D020EE69E1E6C6B89F3E9408352727F93D75110D608CC392704F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213141, "uuid": "f1cbfa5c-43a7-487d-9907-f81a0aa800b8", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213141, "uuid": "78c1cfbb-ba2a-40ed-9a07-9641bd21acb9", "value": "12288:bVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:6fP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632213141, "uuid": "6ac6fd63-3cfb-433b-bd8d-6ba73e546ae7", "value": 1789952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632213141, "uuid": "84d46973-6856-4bf6-809c-c13b207a3284", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213141, "uuid": "4590155b-3dcb-40e4-bfe4-1848b03ea44b", "value": "d5f06f4caeda0e1b09b93132f71b63e606565c6b3f3951bc6428ed702c8cf607", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bd42871-1b0e-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632250768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632250768, "uuid": "cf3018e6-51df-4406-a703-687f5c6378fe", "comment": "Malware payload", "value": "a0badac14c0a8e208befe45bee72f859", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632250768, "uuid": "d22b19fd-706d-49af-bf13-4a5898c16156", "comment": "Malware payload", "value": "d7e8e07aba0628085bbedf36d5ecbad657c1e091c887f9b178dff48170397870", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632250768, "uuid": "25ff2c33-9204-4241-a856-da24f18b7463", "comment": "Malware payload", "value": "9ed39a130fac2b9a4fd3fc95db8c2e422bdefd0e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632250768, "uuid": "697bf622-753f-4dbd-a0a5-e4554660cbe5", "comment": "Malware payload", "value": "a5c4b2dec4ba00fd8fd50bbad641d93168f5114cb2e2ab44032410ce6d361248a8b3fae2b142b8c40a86f477c60ca2f6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632250768, "uuid": "9b73532b-0e1b-4630-b6c1-3c80c2c1f967", "value": "T18F23F14F7A14DC12EE4B9AFF23B3DD629AF49A249127503871D3B8E247CC99708C9708", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632250768, "uuid": "0ea9e69e-e575-4e2a-921a-660800553081", "value": "768:d1QSc4K36PjEu9f2nJNln2/IESjReEr7U568FD0Nr68vL7UMZGT4deJGIn+ZSobZ:dOSc4i0Ox2QEUosED0N3vfUMby5jO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632250768, "uuid": "92b3c78b-b62a-4b3b-a0e9-454ab2939a6a", "value": 47520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632250768, "uuid": "e3342ff0-b9a4-4a23-bb3a-b8232d16d8c0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632250768, "uuid": "88959750-4aa4-4ada-bc12-523aa922f20f", "value": "SecuriteInfo.com.Linux.Mozi.M.12363.14704", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "547a1b57-1aba-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632214812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632214812, "uuid": "ad4d59be-052f-44d3-baee-ae908e9f92b5", "comment": "Malware payload", "value": "8df6d5b6ce4864ae629684b7566ebaa7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632214812, "uuid": "b6953c21-8daa-46a8-994c-df4b5ca9fc51", "comment": "Malware payload", "value": "d83d1ebc7cffb2050517fe68343b2a4cb4e7ed7f45aa2c14a2dff25a8eeb9c8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632214812, "uuid": "d88f9f76-af02-4c9b-9edd-12232e2699f6", "comment": "Malware payload", "value": "47a9b67b6b71f6b55858fafc2c5afc59f0900c63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632214812, "uuid": "6aa5311e-0641-4417-84db-5b5480f1fda6", "comment": "Malware payload", "value": "1c1a7df82360a0df2f3eaca5aa70715d48a70ee99847832e2db0c34ed89363d5fd9c26e900f92022fa48dbe6c0e7ed54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632214812, "uuid": "8950e15b-9cff-4e58-8708-e29da19aa14f", "value": "T13C937C1033E99124E1FE9FB5B8F12142857EB79B5506C4A92FE0419E0A337C19A11FF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632214812, "uuid": "b45e3f03-ea53-40a4-9c37-d59a57b0f9d7", "value": "1536:LFyQp2jnkQy9xxrnGxElKCkkG8FvysAgCWlfciwYC5b8cv1cOdOpcQUDD0:LEQ8k7XoPExysAgCt75b8MeWOpKDD0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632214812, "uuid": "26c62a24-2b2b-437d-a907-7d13f482cde6", "value": 93696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632214812, "uuid": "4e5d8871-5e0a-4811-acd2-94080e4b85cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632214812, "uuid": "349e6ee5-aa15-49e7-b093-3c247cae0d65", "value": "8df6d5b6ce4864ae629684b7566ebaa7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cfbe0da-1ac8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1632220839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632220839, "uuid": "4e3a5e55-3605-422e-a09f-42cd5ed8b017", "comment": "Malware payload (ArkeiStealer)", "value": "0ce36f818bd21747d974bd4e01a5d941", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632220839, "uuid": "2e285901-8b14-4e7e-8050-7ebb6d5d1c62", "comment": "Malware payload (ArkeiStealer)", "value": "d899fbe8a5312cafff5ab7ef99d9528be0656c1590e1d3eb2c97905a46c480d1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632220839, "uuid": "6c86d647-48fb-41d5-9e59-e5707b92cd14", "comment": "Malware payload (ArkeiStealer)", "value": "4e1ad3c973566614b84eb37b2a11da1aa3a4a6ed", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632220839, "uuid": "99a7c55e-26d1-4255-911a-ae6342999730", "comment": "Malware payload (ArkeiStealer)", "value": "ee818fdbb2c72a245bc6db69f6bac02e094c14777d84fdd3cae871ca07ee29a7c5b3450dd18bd8ce503c8fb62ea1706d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632220839, "uuid": "cdbf90d6-13fe-429e-8878-fdb885d06b32", "value": "T102F4F134A6F0C031F57B02F459BA9BB8A9393D715BB481CB72D126EB56382E48C3175B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632220839, "uuid": "2e15b9d0-52f6-44d1-96b4-8e4ce5e2c351", "value": "8447a74d20f094dcabf63f6ce92f5cf9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632220839, "uuid": "fede0cbe-d4ae-41f0-afa0-bcfbdcc2ddb4", "value": "12288:lAcPcwIhasCcUkkAFWBWtJzGbZrHYu0b7PXmX/ClhHuuF3cRbUm:lZjI4V5RBWjzGNrHQPXmqd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632220839, "uuid": "8c5c9b9f-40b3-4da3-9c08-02b617b8aee9", "value": 771072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632220839, "uuid": "589b9414-aad3-4346-a402-2572f2975e17", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632220839, "uuid": "822545c3-84ee-4d6b-949a-de221c57e886", "value": "0ce36f818bd21747d974bd4e01a5d941", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7df1e3df-1b09-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632248812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632248812, "uuid": "3552cfca-aeed-4b7f-8d3a-9d1f33361a4e", "comment": "Malware payload (AgentTesla)", "value": "64749358f45f9148e029cf75ffa877c2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632248812, "uuid": "2309f009-183c-47f1-adf1-3a5d30d59bf8", "comment": "Malware payload (AgentTesla)", "value": "d952b7502f366c05339ef2e00b82fd14b26055c9f7a2ab692e0b149d7b00f1fd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632248812, "uuid": "412789ae-fc67-4c26-a6ba-308d2a882512", "comment": "Malware payload (AgentTesla)", "value": "18647fcfe1995a39452c16635fa880daade00508", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632248812, "uuid": "14d8de4e-0a38-4c34-8dd1-b85024137463", "comment": "Malware payload (AgentTesla)", "value": "9af223f6a015eca90489b70f4dee915051c2aed824e4f88219ee323b1c9b6d9de10842a5137a69aaaefbb24712317ba3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632248812, "uuid": "b3846a2d-9193-4773-b699-d95edb00cf69", "value": "T1660558394D2682F747EEC66CD08C1BCEDEA6A4837B919F1AC496D7D2025B70FE48845C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632248812, "uuid": "f881aff9-e94e-4a9b-907b-12f820152b1d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632248812, "uuid": "f24eac66-5709-403d-a5ef-aacc2c5f759a", "value": "12288:j7wsKK7A4f8mWs9Un5R6Jw6n3jignLwY:sD45D9Y5Riw6n31", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632248812, "uuid": "9b6c7235-b44f-4ea4-92cd-47aa1f08f5fa", "value": 863744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632248812, "uuid": "00b3cc6d-f3d7-4d43-92ba-d5f570aac18b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632248812, "uuid": "2e66a7bd-fd31-4e21-8900-c9cb47fec7d4", "value": "00987654345678.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9726c863-1aaf-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632210199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632210199, "uuid": "8c3ec97f-6deb-471a-b836-23aa03afd01f", "comment": "Malware payload (AgentTesla)", "value": "de3512a98a3dda9d3e8dab29ee7303f3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632210199, "uuid": "e8f4802c-293c-416f-a8e6-c4acfc2dbb1f", "comment": "Malware payload (AgentTesla)", "value": "d9b0df2ca6f50b27e500f94640095c197c023e176a155b33dc060307171e9ed4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632210199, "uuid": "d04ef01d-6291-45f5-9a4f-3e3ce36a5fa3", "comment": "Malware payload (AgentTesla)", "value": "1a5390ffe5c9633c338394fc432e755a7c6a549a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632210199, "uuid": "4bbd0e18-d1e8-4a94-9d68-3c346a260944", "comment": "Malware payload (AgentTesla)", "value": "e1209757bf2df10509f12cf6f7fa37445d144082033d94f9322aa1b7b7403bb3fe51626dbeb90e14bc9b678ceafe06b6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632210199, "uuid": "970afb09-887d-4b0d-82be-3a268d4f3fd1", "value": "T166C1D806B3D88327ECB70B792CB353409178BF21D963DF2D36D8411FAE167549961B61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632210199, "uuid": "327e1ea5-ca96-46b4-bd06-75eb4d584000", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632210199, "uuid": "1440bcb6-eaf5-42f5-8759-3f119fcda0dd", "value": "96:R8N+z5XkWjP6jZ1+w2bBgmg29F7VVzNt:1yZwL9FJv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632210199, "uuid": "8f8666b5-e526-47ce-8121-ee4559552423", "value": 6144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632210199, "uuid": "6f0a62b3-6652-4351-896d-e982f84bde03", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632210199, "uuid": "413e07da-680e-4d60-9361-8a94556fcf5b", "value": "\u00f6deme makbuzu-i\u015f bankas\u0131.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daec04c8-1ad2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632225345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632225345, "uuid": "f22b8794-a637-4b97-871f-7f16835b8e3e", "comment": "Malware payload (RaccoonStealer)", "value": "6fa7f8fb04d2bff1ea40fc7ab0e48452", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632225345, "uuid": "e59c9731-9455-4991-858b-c7825ae705f9", "comment": "Malware payload (RaccoonStealer)", "value": "d9b45bfb22bcdbede7230846c90079c50b760e41c4f510ad547dc68bf38d9c45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632225345, "uuid": "33994fd4-3e81-4335-b93f-bfc24aa1434c", "comment": "Malware payload (RaccoonStealer)", "value": "c66fcba85d3d490ee3c6db6ca01157bef4ea6c7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632225345, "uuid": "6842c575-3780-4eea-bc02-ed6572e33e83", "comment": "Malware payload (RaccoonStealer)", "value": "72de97d4b7a5a4069df3fc8cdc877b42704400cf3978aac51bbae23ae63692b9520cfbce393ddf05ec9f059259e897a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632225345, "uuid": "3489e80f-16a9-4f76-ae09-7e9ef777401a", "value": "T170B401003670C531D5A79270CF74E794ABEAF85154B4874B7BA22F6EEF30381772A25A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632225345, "uuid": "02b9c327-38e5-4b5a-8146-9fcb8a746c35", "value": "b4a5f131bf57e0871ab3cda52113b279", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632225345, "uuid": "6b31c2e7-d721-4ad6-b8ec-28b563a5c52f", "value": "12288:WMHY8bmRmJWEYbOLquUJWB4z3vuV2qxAxBai:pRbkm/YbOFZBQvudmxh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632225345, "uuid": "f89ef716-7d63-43d2-839f-1fe84bb0493d", "value": 497152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632225345, "uuid": "8963f70c-7da1-4beb-b3e3-527a51ad21b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632225345, "uuid": "79cccbe7-c39e-44d1-a250-4fbf7ca410b9", "value": "6fa7f8fb04d2bff1ea40fc7ab0e48452.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ca5c2a3-1ab7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1632213484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213484, "uuid": "59cbaa03-0665-4257-a90d-6bc40a96aad0", "comment": "Malware payload (AsyncRAT)", "value": "28c15f85e43bcc8b38cd8b42fae240d8", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213484, "uuid": "180ceeeb-add2-4325-a721-6a209165e610", "comment": "Malware payload (AsyncRAT)", "value": "d9ca56a09e3bc08340cc4915e1459929cb22f0fdb15c8dbcd05e3beff4237afb", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213484, "uuid": "33c22488-45a2-450e-be89-4971715ae45e", "comment": "Malware payload (AsyncRAT)", "value": "75d97d091cf3879f19e53d24b630d5c2aa1ba545", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213484, "uuid": "f95abe27-ef3e-4e1a-a224-acfd4a04c490", "comment": "Malware payload (AsyncRAT)", "value": "863ce056c9cb85dadcd0302865133bdedadc5538e5e02882a9ee8d6edcefa6c05bae25aad6f19365b1b711c9618d4fd4", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213484, "uuid": "7fff15bf-13e2-48a2-829f-7703739c6e07", "value": "T1864523937C14CCC8E83F5E35BA73F428607E682840951689D85F2EED27306A7BD9EC65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213484, "uuid": "c3d2e0d3-8288-481e-b6af-52a5c46b5a78", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213484, "uuid": "215fb112-389d-4df2-8a80-687f39ecd832", "value": "24576:i9x3ptZ5Sk25IpT2zz2Rm8bxkoNsrFgRcg5Sc0ZqZlqkbaVrqo5jDlDonToI:i9x3pzIkFpw6RmSxkoNsrTg5v06dbaVE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632213484, "uuid": "414d349d-8e0a-44ed-aee2-dbc87eaabbf1", "value": 1231360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632213484, "uuid": "0c348162-1456-4801-9268-a814842f0f37", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213484, "uuid": "2546b09a-cdaf-4dfe-8114-da42077cc087", "value": "d9ca56a09e3bc08340cc4915e1459929cb22f0fdb15c8dbcd05e3beff4237afb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75bef095-1ad2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632225176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632225176, "uuid": "48950be2-3ebc-4051-ae9a-f7ba15233549", "comment": "Malware payload (Formbook)", "value": "2536c125edc35ac5061b596308ff8dcd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632225176, "uuid": "fb494474-3a5d-4fd0-a4fa-6b8a62457bd1", "comment": "Malware payload (Formbook)", "value": "d9cc0ba64d20a3a60f1580c74ff1269f5b545a0abf23362cbc678b12057a6cf3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632225176, "uuid": "c6801962-9d1f-4744-95c4-66cca45667a4", "comment": "Malware payload (Formbook)", "value": "d0506e1bcdb5c8a3714ccb0fa6603173ade0baf7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632225176, "uuid": "01b31fde-45c5-4a34-b252-2253bc4a7f94", "comment": "Malware payload (Formbook)", "value": "8a2a461ea9dec7cf50f3b2ba7a8bc85bad7e52387084ad00a77889431894b3f3cf319a1a3b4cf25adb87463379f4020a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632225176, "uuid": "27f00a59-5005-47e0-a31d-ccd133baa38e", "value": "T11ED4015170AE8A64CB9E7BB660A58350BF337E765933D61D26CD708E0B376814E31B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632225176, "uuid": "6872fac4-1d4d-4411-a9d4-6eb9b2cd8574", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632225176, "uuid": "e1737118-21b3-4c8a-b58c-f1a2e5c4f68b", "value": "12288:upIbw8eGGmtiK5o9ItdC/wVB6VCDwomQZG5navY863Zx:fbw8eGG+Fo9ItdCaB6EDwIQavn6Jx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632225176, "uuid": "bad21ded-0a0e-40b0-ad9e-d857cd5f40be", "value": 606720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632225176, "uuid": "deb1dff1-a16b-4734-a747-a3f37e9328ea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632225176, "uuid": "463d6385-0a6a-4801-bcbb-1ac62d8e7f41", "value": "09021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f67e830a-1ab5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632212936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212936, "uuid": "9efbbf93-ad6d-4a72-a23f-ae989f27029a", "comment": "Malware payload (Dridex)", "value": "c269ce3b09511a99dad64de7b249b221", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212936, "uuid": "304b4813-3cb7-44b6-b39b-5bf0a2bc2976", "comment": "Malware payload (Dridex)", "value": "da6be58224fa15e3fafa01a4476385134471e272f774a4c6bf1eb009e6669b3b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212936, "uuid": "671ee5b4-9b12-46fc-8d0a-10b218eec890", "comment": "Malware payload (Dridex)", "value": "9351cc476619be99e106f1d0f43290276e9fdb19", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212936, "uuid": "147abdec-9577-4efd-87dc-f8adb05f8137", "comment": "Malware payload (Dridex)", "value": "8422e2372869214387b7b3efacaf83e4a559768cc9b646c10390015aa7448219a1a5709a7398ed255cc4fa87c5f12ddf", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212936, "uuid": "91406867-e1d1-463c-b24e-399e5e979ad4", "value": "T11AB5D020EE69E1E6C6B89F3ED408352717B93D75110D608CC392608F5EFC6546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212936, "uuid": "1e04db8c-45cc-4a28-b696-31144452a625", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212936, "uuid": "0a868598-6abe-463d-b6b0-1682537df130", "value": "12288:9VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:kfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632212936, "uuid": "b929c0f4-10fe-499f-9285-abbcd8f73a3b", "value": 2416640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632212936, "uuid": "b2512604-f490-4704-a74a-b0a9667cefa6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212936, "uuid": "d1bb506e-8cce-4d57-b43d-0617b0d8a904", "value": "da6be58224fa15e3fafa01a4476385134471e272f774a4c6bf1eb009e6669b3b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4a77187-1b10-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632251883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632251883, "uuid": "143e183d-95ef-4b7a-964c-b7b4e6dd87ce", "comment": "Malware payload", "value": "a2e30f0fc9755e2d7364f392f2debf44", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632251883, "uuid": "e1059924-5a6f-4d1c-981e-706c13a72569", "comment": "Malware payload", "value": "da9b1c3df5275881ec37764dc1a42d70f09867165bbd46fbd1c6d0d138d903a7", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632251883, "uuid": "417a81ba-c2de-4370-aa5d-c81b16001963", "comment": "Malware payload", "value": "69cefdfd44486059916b1a37d380975c44850adc", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632251883, "uuid": "6c448a31-bdb1-40c4-8053-21dbf2b3b400", "comment": "Malware payload", "value": "41b6ed7f9034684477ca1127a1463fa4cbbf1858e1df9159b5859f402f4d44c2b076e379e8263e0ddd14a5896a00ec3c", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632251883, "uuid": "d668d1b3-bc67-4131-94a8-6e78f59c6dda", "value": "T16EA3DF8FAD4B81E0E10F10B3A08C4273EA6D4295D409A13F6EEE15491F75CBE8B55B9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632251883, "uuid": "29ed8c50-21ed-4c01-85be-a86c22920bb3", "value": "3072:46SKmAm+ZAJNb2YrKazI8O2uopLZFr2WuhdhSW:z/mcZiJVvr2f3D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632251883, "uuid": "d40add71-28ff-485d-8b1d-1a390601e357", "value": 105916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632251883, "uuid": "757371f3-ecd1-4297-902f-a81166a8c0ea", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632251883, "uuid": "cac429e1-2a57-4fca-b4b7-45f70e62ab6a", "value": "SWIFT_DETAILS.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a58bce51-1ade-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632230410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632230410, "uuid": "87ee155e-b0fc-4416-9e74-b2ae8698e515", "comment": "Malware payload (AgentTesla)", "value": "cf1561d01e9c75635b6f1d27cb8f60cb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632230410, "uuid": "a8afdb5d-11c3-4e75-926e-c2b0d6dba874", "comment": "Malware payload (AgentTesla)", "value": "daee7a73a22fd5a2c4e44aa76329ab152c95383d0c89582b15270362f9265897", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632230410, "uuid": "d9329406-b16b-43ba-913c-3ac5b21b5454", "comment": "Malware payload (AgentTesla)", "value": "ec65021a5c71b4f0532b0bc6ff68ceb7ac370ccd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632230410, "uuid": "7f4e8ee1-5333-4743-a879-3c12842bf103", "comment": "Malware payload (AgentTesla)", "value": "e3f4d1effe913286ef10dc212395642565f1039a1d93bb463ce5207f378cabfcc2ec8262bb26ed0c6bc4a3b3bc26d8e5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632230410, "uuid": "f13c006d-ecff-48f9-8385-c7e2ba8aad1a", "value": "T178059EC17D47DC9BF4DF6AB398AFC02011A46D8D9161C73D26927A2B54F335230ABA4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632230410, "uuid": "69e4a3d5-559c-4101-b919-781b980f9d7b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632230410, "uuid": "b59f2940-a015-490b-8419-66d7d350e322", "value": "24576:4R+FoTDRfALoxJLjxszzkcbTG+LamaZK:I6otAqJx9cbTNaxK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632230410, "uuid": "9b85d605-97ff-4ed8-b851-73bb396ae0ac", "value": 832512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632230410, "uuid": "09d0ec43-1aad-4570-9a8a-c436e65d685e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632230410, "uuid": "ff9bb2ae-b8c6-4d59-a992-df323584967d", "value": "Payment Advice for order 19203-319203-4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "704a7c57-1ad2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632225167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632225167, "uuid": "d1625d21-f034-4ff2-a3a7-25a1349cbe26", "comment": "Malware payload (Formbook)", "value": "bacd65cdd5bac7dffd56f6c9d8f8236b", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632225167, "uuid": "4c76a953-809a-4df4-821e-8beb62031318", "comment": "Malware payload (Formbook)", "value": "daf2171fbf6da5a14b9ac720e3f6a1f75d8d7c1d3e3be02c308ae4faa854eb65", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632225167, "uuid": "4664e8ea-3649-4e66-8b1a-e59d9326a174", "comment": "Malware payload (Formbook)", "value": "44e1e92010cbc510764461ce58aedf518cf8562c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632225167, "uuid": "1247c25b-670f-4d0c-9886-46d60e5e13ed", "comment": "Malware payload (Formbook)", "value": "e9aa63cb13567e3b67111e6d51a345e6fbd600482e790493ca6c9da4d0eae70f422d04c9c1e1321adfadf62a45e7b854", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632225167, "uuid": "1c5d902b-8e5c-4d5a-acab-733cf7590836", "value": "T18FB423067EE92ACCC8A32A70F40E30E45667E55930F73E5759896350CD5D823F4EAAE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632225167, "uuid": "66df2194-d2df-4bf7-a36f-598f9e1ba427", "value": "12288:cIa964HE7WYzDzDn3zJJ3KilWpq5VAPOSl9+ZC:cRNrYDXn3LaiYeVAPOSH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632225167, "uuid": "d65801a8-5e95-4ce7-b91c-fcd3335f7bf0", "value": 535763, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632225167, "uuid": "5b3ea2e1-ea68-4a8d-a90a-a47ddb9c1d9e", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632225167, "uuid": "72da3fe2-d202-43bf-877b-6fbfb26f67ec", "value": "09021.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1f66349-1ac0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Matiex)", "timestamp": 1632217519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632217519, "uuid": "1efda632-46ca-43bc-b36f-4bbf526d1131", "comment": "Malware payload (Matiex)", "value": "3419295db11946820ce86767e1c6b52d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632217519, "uuid": "30e284ef-2e0a-4dba-888a-44493e837dc4", "comment": "Malware payload (Matiex)", "value": "db485a49123c13d37791d080ff2987e2e8f4c2abc5645b23a8acd9a8834e5418", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632217519, "uuid": "ccb306a0-3da2-48ac-bf86-2783cfa8568c", "comment": "Malware payload (Matiex)", "value": "de184eb6c8e8f890b0daa28d5c9ec0fc6532542b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632217519, "uuid": "5716b79d-fdb4-4d24-80bc-a5713e39e4d5", "comment": "Malware payload (Matiex)", "value": "fe558aea119a1245ab2a75482ff8102d7edd07c5aa398ef529f9a83fb7ef51bf198a90f51004e62462e3c8814432aec5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632217519, "uuid": "bd15c809-c937-4ab8-bb79-1e3fbcf147f0", "value": "T16294AE3117C2FF96D7AACD38DD172C104CEB2A5342734EC8B54929DF90AB118EA68977", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632217519, "uuid": "d817701c-37f0-42a2-a4dd-c94909e8a4ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632217519, "uuid": "3dc23a4b-658c-4683-8ecf-ed6b923cf58f", "value": "6144:xccRiEcrjLY9U3B6dmtEXtzfYxjcUeyoVan+bPV5GnLYV1E8wsqaUdoChwxyECPm:xLa+bPV5GnLtlsYtw8ECP/REY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632217519, "uuid": "425c111d-d8ef-4a29-9f7f-b96931aeebb7", "value": 410112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632217519, "uuid": "d840cca7-9098-4b87-a21a-075b8a11b8fc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632217519, "uuid": "2df4f2cb-9109-43d2-b162-516576895c6e", "value": "Po#6672.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fe6646d-1a72-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632184015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632184015, "uuid": "c17d7372-bced-45df-a766-160ea2a4285e", "comment": "Malware payload (AgentTesla)", "value": "fafeb784d7ac5fcce8df74a9015cb660", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632184015, "uuid": "2db747c2-317b-41c6-82ef-1db5af179af9", "comment": "Malware payload (AgentTesla)", "value": "db48a21a6f575ca9f5faddfa9fe6f72e0b261579b2e0182440c7a2dbb943b355", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632184015, "uuid": "d5f164c5-2875-4246-ab66-caf293843af0", "comment": "Malware payload (AgentTesla)", "value": "2aca288c2ebc458d6bef97f7e26ea78d85c78312", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632184015, "uuid": "1ae3c382-d07e-48ad-b129-aefafbd4c07f", "comment": "Malware payload (AgentTesla)", "value": "5e43ac028ee19de9a0abf5208f9b67c891055deaa69722eee968f0f8c8fe3ce4d3d0dce1d50a40a0ebde1e08061bc83b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632184015, "uuid": "d850b47f-8426-4818-a240-575b0ff927dd", "value": "T19734127642D2ECB7C88293311837FB38F7F397650952D90257FA0EFB1C924175A8929A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632184015, "uuid": "335b6d8c-6f34-4a35-9b3f-8687d7a7777a", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632184015, "uuid": "41583d15-f58a-4c7c-862e-c6e8c80b9e8a", "value": "6144:R8LxBOruzMyGRe7nWM1N6ThDqT5bB4Alb20eFCNGbf:ZrIlIe7nWM1NimTtB4AB20eFkGbf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632184015, "uuid": "ccf8c8f7-347d-48d6-92e8-fcaf0fb76b64", "value": 246113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632184015, "uuid": "ecda4aa5-2322-479b-917c-90ded5a6f6b2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632184015, "uuid": "3e1ed0f5-cb38-493e-b75a-ac5490f59736", "value": "CATLOGUE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c078bd1f-1ab5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1632212846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212846, "uuid": "81a38d17-acbc-4c11-bf86-b2f9ca16ac32", "comment": "Malware payload (AveMariaRAT)", "value": "ac28b12bb688da3fcc1a332c2428ce6a", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212846, "uuid": "33d9aa61-6ae7-4028-ac10-d02ed8d99445", "comment": "Malware payload (AveMariaRAT)", "value": "db7884dae67da1db81ee6071b96ff8c1aa83aea3f7adaf9c57eff4ecac9f17b0", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212846, "uuid": "a5f5cea8-7071-4e28-9694-81775b42b183", "comment": "Malware payload (AveMariaRAT)", "value": "2560fe5dd3342a1346abef5053e355c58dfe0405", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212846, "uuid": "a6396999-c7db-418b-8d82-045d7ad5681a", "comment": "Malware payload (AveMariaRAT)", "value": "a58177a66e039c23b0192b6e034f7117f89a00891f9b2c505c4c4ff8254043660e12942d84fc9ed986bb4323028dbe48", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212846, "uuid": "98d4d74e-bb19-4d60-ae7b-6c88b1f8da29", "value": "T17CE523F02CC63DE3F47A7F7BE2ED5A110584EBA7CE6D95367F20C717420AAA50A01859", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212846, "uuid": "e4088880-2d5e-4906-b40f-4829caf318c7", "value": "c19c5a27cf193c3f49f1a5b91054e502", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212846, "uuid": "834da38a-9f93-4533-9f9c-a28d6d6c204d", "value": "98304:jZoacYTxZLPM3drfOybRVMs/MF9lDfVWnuQXGPGmg8J4:Oacw7MNSybg9TyGT1J4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632212846, "uuid": "ba089cf1-851b-437d-b736-59b920a57e12", "value": 3154785, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632212846, "uuid": "afeaaaed-bb3a-47cd-8a0f-0c2411edacc1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212846, "uuid": "528efc4e-5588-49dc-abf7-839700cd56e3", "value": "db7884dae67da1db81ee6071b96ff8c1aa83aea3f7adaf9c57eff4ecac9f17b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "542c9ec6-1b09-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1632248742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632248742, "uuid": "9aed3911-180d-42c9-93ae-07ef0ff551df", "comment": "Malware payload (AsyncRAT)", "value": "bfbe89c59762c5d8071a3cbdef890783", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632248742, "uuid": "7c2f6158-40a9-418c-a8db-ac6778187fe2", "comment": "Malware payload (AsyncRAT)", "value": "dcb1bbb6f69b880896f615b9ad613ad5f11bea4ddce31f5a18a0616cd600799a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632248742, "uuid": "2edb131f-4517-4621-9d28-c90cb13f64f7", "comment": "Malware payload (AsyncRAT)", "value": "6af67257401bd289c148424deee9ef53d6b55868", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632248742, "uuid": "2c0b909a-2dec-4866-bc87-ce6dbf6d1c6e", "comment": "Malware payload (AsyncRAT)", "value": "294956842f80f8bdd6f3596e0499a6855c59709841d3340e067de3764a64d2f73503401612b5ad9f2017e3935c54e2ab", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632248742, "uuid": "5455e3fc-ef6e-4d84-9f8a-8bc52f688cae", "value": "T1EDF12D2EE0A3D5514769C302CB98BE2C5C1D0889CA35B95CA5F76680AF30FA46A54F7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632248742, "uuid": "8e74ead4-c41d-4c09-bdd3-7b5df3db070d", "value": "192:2TjQxEFXNIFX0zREJXCIjX+ReEIX2IhXodN2cxVpN2cC:2Tj2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632248742, "uuid": "3057cf3c-a84e-4d1c-89e4-f5beb62d13a7", "value": 7772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632248742, "uuid": "036ece50-389d-49d6-b942-aefc0411b59c", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632248742, "uuid": "1d3016b1-0ee6-4573-aea7-fdc88405bf10", "value": "Billss-1873578583.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "182e8af5-1a96-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632199249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632199249, "uuid": "1d462487-a36a-4254-ab59-14b46ae269c4", "comment": "Malware payload (RaccoonStealer)", "value": "0f0e4ebd92022809fb0277c12a467d13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632199249, "uuid": "f3af471c-84d0-4a38-a149-c0605ea2aa5d", "comment": "Malware payload (RaccoonStealer)", "value": "de76ce9c9405822c148b59c539781b7858c6ab67134294e60b70e99f9a4098f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632199249, "uuid": "41bbf8c9-4e17-440f-a9df-8c421fb915c9", "comment": "Malware payload (RaccoonStealer)", "value": "ca82d8e4996f7e6b9353589a737d5d2b73d1e1ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632199249, "uuid": "4c912cb8-e279-4b0a-87c2-8bf1ea18250d", "comment": "Malware payload (RaccoonStealer)", "value": "1228df68da8daa22cae8af39d3942aadbf2aaac605c8332397cf7c4aa8560d2891f8d261505cd2785ca18a5587d0892c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632199249, "uuid": "d8da82ad-0c21-46e5-ada1-e3ecfc0a53d7", "value": "T134C402523950C073C0468571E8A6EA709AAC6CF15A774947F3E86E7F3F636C11AE720B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632199249, "uuid": "4fcb1a17-3c87-4787-aa4e-411840cb3c5e", "value": "550007421ed2c731728581b689f3b64f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632199249, "uuid": "dd5d3df8-8c55-431c-bbf2-9fd5e7fd740c", "value": "12288:wzXUjXab6x/Jkv8QkyBfa5UH5Z8RFyWM0exQ:wO26ypeUHTnQuQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632199249, "uuid": "d7debad5-9269-434c-8518-55b3f88ddb30", "value": 559616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632199249, "uuid": "0546383f-81f6-4744-a992-8a75aeeac98c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632199249, "uuid": "94c49995-34f5-42a4-80d4-60f871097c88", "value": "DE76CE9C9405822C148B59C539781B7858C6AB6713429.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18503260-1ab6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632212993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212993, "uuid": "0bda6531-8ab6-4c68-a332-aaeff67ae784", "comment": "Malware payload (Dridex)", "value": "26edaa06da101493f7afabdd84d911b0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212993, "uuid": "de1700e1-39f2-4f7d-afed-0c257d34e8d4", "comment": "Malware payload (Dridex)", "value": "e09a38acff7ed69f5561263cdf5a96831f58ba2a56c1f74203758c574ef38a62", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212993, "uuid": "b917b574-53a5-4a3e-9afe-e3315ed5f86f", "comment": "Malware payload (Dridex)", "value": "40714101a0ff3228df24f5d1e08fe08619f6e033", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212993, "uuid": "6e1b5481-9525-49b2-aa25-2ad53cf8e8d4", "comment": "Malware payload (Dridex)", "value": "14e077462f9fa2b415fd8099fc037dd42134d6b9fbb52832b269a48899ff0997c5cca60a9efce731b63a802413d9be51", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212993, "uuid": "094499e6-e9b1-4ccd-bad2-8b67da166d0e", "value": "T120B5D020EF69E1E6C6B89F3E9408352727B93D75110D608CC392604F5EFC6546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212993, "uuid": "91f3960f-a9e1-4dbd-84a8-9a862f4aa5e0", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212993, "uuid": "b07141fb-bf6d-45cc-824e-847280e57a10", "value": "12288:9VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:kfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632212993, "uuid": "a735ca5d-f57d-4fcf-af4c-b6b0b792ce7d", "value": 2273280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632212993, "uuid": "5095955b-ebd1-45d9-97fd-098802dc5aff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212993, "uuid": "f5935467-ac3c-4f53-a55d-db9df35c53b3", "value": "e09a38acff7ed69f5561263cdf5a96831f58ba2a56c1f74203758c574ef38a62", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9cc0915-1aad-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632209452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632209452, "uuid": "ff1be942-cd20-4c69-9831-c5ce87910547", "comment": "Malware payload (RaccoonStealer)", "value": "89e9ce1e1de02f4bdb2f088219ac4438", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632209452, "uuid": "e664f23a-65c2-4592-b045-39e37e60da88", "comment": "Malware payload (RaccoonStealer)", "value": "e1ca919efc38953fe8529dadc710aaa5a75000279041e1350c699e36525abe7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632209452, "uuid": "4159c2f5-41d2-4ae8-97e9-c4e746f7bf55", "comment": "Malware payload (RaccoonStealer)", "value": "952b79c03ee7626dad4077f8522a824759af2b3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632209452, "uuid": "1b8336ee-e102-459a-a86a-f01c3dfb265c", "comment": "Malware payload (RaccoonStealer)", "value": "e0c5e19ef378c3bb41c03bcd18ffc64553c36328021e6e21b6e8854ffc1ff905db36fce9889cd3467446adcacdc5c52a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632209452, "uuid": "86649fe6-e3eb-4c4e-af9c-f08f16badec3", "value": "T1C3B4018039B0DAB1D0AB95B14731CAA01A76BC1199709BCB7B65776EFF342C23727349", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632209452, "uuid": "916e4457-404e-4aa7-b398-b1dea9673476", "value": "671b36eaed947d2e663f25178077764c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632209452, "uuid": "32d0a5f5-2b87-4ce1-acbf-d4ca063eac74", "value": "12288:dsNSGCq0nGs7aMKOA6dYx93sBtAK5Bai:mNpC6MKOXXKMh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632209452, "uuid": "8eb908d9-bb06-40a6-bc3f-5a58907a9b53", "value": 513024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632209452, "uuid": "64082da1-11fb-4ef2-9929-93a95376b90d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632209452, "uuid": "3e0ea2a0-6ed2-47a2-9c3a-39c3180ff489", "value": "89e9ce1e1de02f4bdb2f088219ac4438.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "450e3285-1ae0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1632231107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231107, "uuid": "81db9d24-8825-4d85-8729-385ba1c09110", "comment": "Malware payload (Smoke Loader)", "value": "050902ef3cb5d1ad0f03b11c767b6555", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231107, "uuid": "8febd002-c8a2-4e1c-ae8a-0c1705352b55", "comment": "Malware payload (Smoke Loader)", "value": "e2182bd67553bff631bb93f7a016163c7cb82485cf9614bf566c9b49e821b158", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231107, "uuid": "c61c6199-8b7a-48bf-a86b-c66c16254444", "comment": "Malware payload (Smoke Loader)", "value": "ad2e5d9f525909ead63b561202391e6abdd59483", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231107, "uuid": "331240ca-686f-4534-8d97-0b8b707c11aa", "comment": "Malware payload (Smoke Loader)", "value": "6b99829331ab74620218af7608d89348b347a7bc7177c2fb5bf2a6fbeafe53e4813a8370076c56b831c21140182fdd78", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231107, "uuid": "112b0b8c-f1bc-4a8b-ad47-aad715eba39a", "value": "T1AD24BE4035D0CAB9D69311305B64DBE026BAFCB1596087877B96376EEF302C077AE35A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231107, "uuid": "345c553b-a47e-426c-9f1b-3c917747256e", "value": "671b36eaed947d2e663f25178077764c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231107, "uuid": "5cab92ee-507e-4a14-96ef-dfea183db8d3", "value": "3072:MxS5xkv/nEQQQQiPYDLTT7rHIU579m9TcgNl0Xidn1Av5IxAwjtqAGM:MDXnbPYPou9ATvWidnShBwjtw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632231107, "uuid": "a5efe38a-0fea-4614-a6e3-f3dcd159e351", "value": 220160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632231107, "uuid": "7e5ff851-2597-43c9-ac10-3761c85c830e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231107, "uuid": "3e454622-9646-454e-b124-f4b983ce2f4c", "value": "050902ef3cb5d1ad0f03b11c767b6555.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c57f618-1aa6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632206343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632206343, "uuid": "5c485ab7-5a8e-4690-9954-c7ab11cefcc9", "comment": "Malware payload (RedLineStealer)", "value": "778311c46a25d8f9fc121f06dad4886d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632206343, "uuid": "048fc6f0-8570-4ae6-b1c5-76d7fe8a656f", "comment": "Malware payload (RedLineStealer)", "value": "e273882fe9b8695ec834971552bad752eded38a5d60c09ea540247ed2afbfc20", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632206343, "uuid": "d9eb18fe-1a95-4df9-855a-c3d2f09d79b0", "comment": "Malware payload (RedLineStealer)", "value": "06959426299a7a1aecd8698c97d68c9c88117719", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632206343, "uuid": "aa08b8c2-1357-4209-adcf-e1b6dce7d551", "comment": "Malware payload (RedLineStealer)", "value": "6d4641f6ab68ab47e922b4ddf56ef814ed41fb77487525ce368931ffd2001a021d037b305bc1a444f774b7ae6e47aff4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632206343, "uuid": "a98056d9-f56d-49c0-bf5b-0de2f53b4345", "value": "T145F519903D0AB19FF24104F49BC7E9875B6906BF93241A19D8F77CBD3267E120DA5B88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632206343, "uuid": "520800be-69b9-47ed-8fa8-2c33894ad6c4", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632206343, "uuid": "9d33c329-80ba-4ac0-ab3b-9dba761b0dcf", "value": "24576:2hTV4R2pQpQdiw3rcSywFGYBwwhGnHRrejl8Z9P2piV83b8REAhH+2pXXvFT2OJY:wTV7+2jGYBI7Y18OxSEwx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632206343, "uuid": "ebf8ccd4-6552-4626-bd47-06d1f2d514ea", "value": 3357536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632206343, "uuid": "5fb1b1d2-ecc2-443c-a010-f94096133f38", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632206343, "uuid": "15276092-fa79-4a23-bf2b-c188cf916892", "value": "778311c46a25d8f9fc121f06dad4886d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bc0aa44-1ab6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632213106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213106, "uuid": "48ca4566-622d-4a5b-bb15-b54c045812a1", "comment": "Malware payload (Dridex)", "value": "45f201fe8836d166520172d5e314f00f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213106, "uuid": "ccf4e63e-0b4f-4b70-b4a4-469da1509bc6", "comment": "Malware payload (Dridex)", "value": "e29f1aa6ba0836b4dea08c59654f4cb1e5eb90c495402fb0d8ef8839ddb6c8d5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213106, "uuid": "8d20400e-ac20-47d4-b226-2ecba10e2b19", "comment": "Malware payload (Dridex)", "value": "e5e3bcfaa1dac76f22e1f3e3bdc672d1133d63ec", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213106, "uuid": "72d7489c-4922-425e-bba2-95cf48089d8f", "comment": "Malware payload (Dridex)", "value": "ea58fd4ffb5010c080dd04bc5e707eae93c0ce5a5bbc9723a4ae4b03114620fc958c37dfbed56f9e080da80ef7b2c3ee", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213106, "uuid": "0617ca45-df1e-4810-a24c-33a346eab180", "value": "T103958C10FFB645D3C09DF73D788D3416B2B36A60811F861D824F231E5CA5B912EAE99B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213106, "uuid": "8d5dde2d-c927-42cc-8002-c52fb33fdc08", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213106, "uuid": "a1d164cb-b8dc-4170-9b66-bc136770297d", "value": "12288:nVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1P:OfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632213106, "uuid": "0f29d828-587c-4028-99de-54f3fd7adee4", "value": 2048000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632213106, "uuid": "12e517ae-016c-4e92-a2ae-4d16ceed3fca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213106, "uuid": "c773ad61-cc91-4a6f-92a7-67e9a41771b8", "value": "e29f1aa6ba0836b4dea08c59654f4cb1e5eb90c495402fb0d8ef8839ddb6c8d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "280d9f67-1ab6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632213019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213019, "uuid": "a3cc34a2-ec74-4e6b-ba56-f6e03782c96d", "comment": "Malware payload (Dridex)", "value": "9d55eb2f1ba5a83937606e4add78a68a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213019, "uuid": "e99fd65d-7088-4685-89a4-cd9bd0adc15c", "comment": "Malware payload (Dridex)", "value": "e2ab0a83191d828f7251f95bfbecd002631a4b6196f221445a237857fa3c650a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213019, "uuid": "e4df3947-9d92-4950-b63c-7fa22a5d74a4", "comment": "Malware payload (Dridex)", "value": "eda25d927b5c1d4b84173bf3bc1999b19b2daddb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213019, "uuid": "c9119b6c-e768-42d3-9bd4-9358c4a9e39e", "comment": "Malware payload (Dridex)", "value": "b9863ca01adc5908c8eebaadc1e6120e57f216c3834294e074aeaa3f251233648e466feca02493c451a45cc9932f051b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213019, "uuid": "b60c859f-7594-40f3-ad4f-3b12d5da42e5", "value": "T156A5D020EF69E1E6C6B89F3E9408352727F93D75110D608CC392604F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213019, "uuid": "43ead1e7-207c-4891-9f78-826b602faea6", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213019, "uuid": "e3c86950-407d-4e1c-8eaa-ea070b90234b", "value": "12288:kVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:BfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632213019, "uuid": "d1c73159-d19d-47f1-a059-53a94f325c2c", "value": 2220032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632213019, "uuid": "5ecc5ce0-11de-4409-93ae-e4cf8f39cd81", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213019, "uuid": "f59c2387-e5a4-4283-9364-7f1b75c72d5d", "value": "e2ab0a83191d828f7251f95bfbecd002631a4b6196f221445a237857fa3c650a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22dd1f29-1ad2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632225037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632225037, "uuid": "af171d94-f9f5-45a0-8129-1acba1c1fc7f", "comment": "Malware payload (RaccoonStealer)", "value": "44f9b01722b1b1fe2cbe724ec2280683", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632225037, "uuid": "c18b3ded-b90e-4c17-9569-88519a121b28", "comment": "Malware payload (RaccoonStealer)", "value": "e365aa3dff18f941f4115d457a1909358e793cfb5877681756fda6adfc3da552", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632225037, "uuid": "990f0d26-1763-4314-b57b-d74978120b5f", "comment": "Malware payload (RaccoonStealer)", "value": "75eebb3789c6db1aa6802f9ef6fbd9f6e5d2be97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632225037, "uuid": "49e462ff-bdf9-417b-9088-c6e92ceb94fe", "comment": "Malware payload (RaccoonStealer)", "value": "b1194d9d4440b69537e22a96b6a1e4962068b65544501ccda5ffee5755443c478b617510aff0dca7bd7c502f725de803", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632225037, "uuid": "3dc7ccc7-585c-422a-8160-9c555d0876dc", "value": "T1A8B412307772C271C693A2354B71EBAC1AA6B42259B097473B16637EFF306D27266307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632225037, "uuid": "729240ba-bab5-4630-b439-b3a9e4cdb3c9", "value": "019bced73b51911db702af2d47c34cb7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632225037, "uuid": "bb7f23bf-d263-49f1-a1bf-80aa62c0ede1", "value": "12288:kEZ8Ql+/2buQeo4cusTTUsKz/xigG1ydAIupkAEBai:98Ql+FW4uTQ9kgTdmrEh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632225037, "uuid": "44531e99-56e3-432d-a3e1-62d494161bd3", "value": 496640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632225037, "uuid": "44ed3876-6d55-4873-8d9c-c124df0e060d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632225037, "uuid": "ef160842-0207-4bc9-855d-eea01beb95e8", "value": "44f9b01722b1b1fe2cbe724ec2280683.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "624e0cb4-1ace-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632223425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632223425, "uuid": "dcef6c0a-19a8-4304-91f6-f0ffeb2641b7", "comment": "Malware payload", "value": "27a5260c3d72986f4e22a50865143075", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632223425, "uuid": "64fa4795-dab8-40a6-a478-2788e9159cea", "comment": "Malware payload", "value": "e3bf3423501a7aa71d8e78171eb61380e1debb275e325e5aa5072003a21ca344", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632223425, "uuid": "39b2922e-775c-48bb-9366-39fe53f1660a", "comment": "Malware payload", "value": "78e271d3605055b2503a8017ea41b0c285188b65", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632223425, "uuid": "3bfd5038-5a5d-4e4e-a54d-19d6f24ee8ef", "comment": "Malware payload", "value": "e313f4c3663e0741047831d0e3cc5d63bf79cf9c36c625d7183de68b305c4796cd0bd8b9c6c74ea361c6f3a61337b4bc", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632223425, "uuid": "2826cacf-2c54-470f-98ed-fcc8ec9b378b", "value": "T1EA94AE57B6ED9E00D7986934E2F709344352EA023673F34F2D4952A27D272BA3D863C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632223425, "uuid": "bad9697c-1c8f-474b-8206-feeba2b555d8", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632223425, "uuid": "5f9fbb22-d81c-4665-b174-81cbf1dd3e49", "value": "12288:t/+P9PE+TJ6ThLYgBnT3UZk1OEt2UTBL0i:N+JbTWLdBnT3UZk1EUTBL0i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632223425, "uuid": "08ced2b7-e43c-4d0e-8e3c-4c42077274eb", "value": 413184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632223425, "uuid": "a015731e-ff55-42a1-a5de-0fbf234ad7b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632223425, "uuid": "d171b32c-b093-4c96-8f5c-f1085d05842d", "value": "SecuriteInfo.com.MSIL.Agent.UUS.32473.5647", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca2309dd-1b2f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1632265261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632265261, "uuid": "71bce679-9df4-4728-b86c-9da578834cae", "comment": "Malware payload (Loki)", "value": "4cd3f83c98b865c4166a16784d544ae4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632265261, "uuid": "bd5c3a41-1d46-4e91-8584-9f06815fd258", "comment": "Malware payload (Loki)", "value": "e4b322d86c20dbd5d5baf50d8dd333e81f5712e7ebe25c3987f4809b0daaf874", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632265261, "uuid": "ebd888f7-76eb-4c66-8c75-af2bfce00122", "comment": "Malware payload (Loki)", "value": "0aa660f0ea7382aa3523b7a6cb8da0974dcc5a39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632265261, "uuid": "7dd99ad7-4282-4e4e-8d80-e51275092e48", "comment": "Malware payload (Loki)", "value": "91397f28b40ae0ae20236afc713bde115b431ff80dae0a391dc4fc98a95e422c8dd5a53a2904c2cee4ec58b104f51677", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632265261, "uuid": "af3c7d64-3ec5-4df0-b16c-f179ef2eb5c8", "value": "T19405490023E8F625E6EE1730E077758432B6BB866139D78D590779BD1992B418CF2FB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632265261, "uuid": "d7d3fcad-7162-4860-98c6-f710b5c32c4f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632265261, "uuid": "028b83d9-025a-43bd-8a68-0d4ad4d2c246", "value": "12288:9pf2Kp9hGiBr0X03m/gecNU2zqX6lUB2Ake:9j9hRZbjDNgWUB2Ake", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632265261, "uuid": "ec9fda05-5551-42b7-96e8-bfb74e28ad25", "value": 812544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632265261, "uuid": "6df271ce-1dc9-4720-b817-1b69442de2cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632265261, "uuid": "0645fa52-050d-4525-b72a-1af4b5c1c8b6", "value": "4cd3f83c98b865c4166a16784d544ae4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b12158d7-1a77-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632186191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632186191, "uuid": "6ff738d0-55b7-4910-bb99-7d56e81096bc", "comment": "Malware payload", "value": "6548f3893e869c485c47a970558dac65", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632186191, "uuid": "820b7e46-0047-4614-86ae-f6671dbfbc43", "comment": "Malware payload", "value": "e5146aff1c22114ad1beaec95f2b79a212b3cedee695dd7684de17ca27389f43", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632186191, "uuid": "0a851e03-e849-4e2c-bb8e-b47d2b0b0a2f", "comment": "Malware payload", "value": "d3fc268e4559727e987559d1f7020ff16b85d72c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632186191, "uuid": "0b75cdf6-4bb5-499e-bd89-8af129b746f2", "comment": "Malware payload", "value": "4f61b0fe3377354be45ee692a59526ab45d74b4af8f577ebd269200fcb6efa5abc3f98626d32c1232a3b013c15f22d68", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632186191, "uuid": "294d9667-f210-43ce-ac74-faaa070db885", "value": "T1610302982E13458BD532247BB54FD855BCC30F16351F489C10B9D5789EF331CAAB9326", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632186191, "uuid": "8d61a531-9b26-4407-8fae-a84dbb0737fa", "value": "768:TDoQtBTX941eYFDgNbl5PatCbYUmQAvv/wY24kDpg9:XtBTX941eYF8NblpuvnwU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632186191, "uuid": "32760997-2d58-4102-9a01-fec058ce0af0", "value": 40656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632186191, "uuid": "337518fa-f8c7-4fbf-b835-81827b3c4f97", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632186191, "uuid": "d68bcd5e-d058-4a24-80be-ae40e5fbf52d", "value": "SecuriteInfo.com.Trojan.Linux.Agent.HIT.6502.10826", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2d3ef7f-1b11-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632252337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632252337, "uuid": "293add09-28a7-4fad-9245-2dc62e2a3b8f", "comment": "Malware payload (RedLineStealer)", "value": "e9433c64de21ee156489ff89c3b8f534", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632252337, "uuid": "c9113787-d510-4a0e-933a-47972c420eeb", "comment": "Malware payload (RedLineStealer)", "value": "e56b53500bf0072f709cec8121a19d8d98a42672ff4df8c3079518d68b6c4f3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632252337, "uuid": "001240c0-a254-42d1-a49f-2c55be751643", "comment": "Malware payload (RedLineStealer)", "value": "748caa1e70f40ebc4941e41f397fdfab483866fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632252337, "uuid": "cf018213-810d-483b-9c48-e669def39ee7", "comment": "Malware payload (RedLineStealer)", "value": "3acdb84a50b3ff438b9e9ba852040edd25ac873b28e5b20937209d9bb2f22970155c434e58b93633eddd09e2bbc934b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632252337, "uuid": "92f9d9d2-3dd4-43ac-835e-16059717ea44", "value": "T19864E00136A0CB73C95315308B25EBE16EBAB922DA758347379B676EEF303D0761531A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632252337, "uuid": "fb53d140-05d2-469d-976f-cfc833942704", "value": "98349bc8fa025f57a9d49df3092c15be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632252337, "uuid": "9927a0ce-0e66-4c0d-bef8-a83974e3f732", "value": "6144:5yZdo9oebLO8Il0iZ0UksLRwATT3jrXBwjtw:4zgoe1f6ks+ADzBai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632252337, "uuid": "ef4e9954-4110-4723-8a79-6d1889fdfe3e", "value": 311296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632252337, "uuid": "7933d45a-72c3-4081-9798-a11b5626ce1f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632252337, "uuid": "abb75431-e0c6-4319-8a1f-9e3d51270212", "value": "e9433c64de21ee156489ff89c3b8f534.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a238b109-1ac6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Pony)", "timestamp": 1632220096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632220096, "uuid": "c4ce22ef-2bf9-4ec8-92bd-11b3db7b0b24", "comment": "Malware payload (Pony)", "value": "36f7551edc73d9c172fa9b2b2731a64e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632220096, "uuid": "a745952c-c301-40f2-9da7-45af27d881eb", "comment": "Malware payload (Pony)", "value": "e5a12cf4cce9ec8ee1d09275355384486d66ea924e5ea38ef879fa6a2e31cafb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632220096, "uuid": "38a716c8-3b88-4ae5-bde3-fd3e05d564ae", "comment": "Malware payload (Pony)", "value": "1b90217d9c1ab7e768a3ca2346d21c192f9ce4bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632220096, "uuid": "cb0712b8-20ec-4144-b9a4-5c99ae8f256d", "comment": "Malware payload (Pony)", "value": "59f532c4a728b91fba3479383a8b747e128b9ff602da7b6ae835d23a84442a520f08c9a1651ca137102d4ee357f7a92a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632220096, "uuid": "db419d92-300d-4f36-892b-95b8f5fe3f3d", "value": "T16EB4F151329E5A58DB9D37B130A08350BB73BD7A2933D14E26DE708D4F776828E71B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632220096, "uuid": "b8b083e1-03d3-4c24-ba23-94b64c64c910", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632220096, "uuid": "01777adc-8219-4f38-ae08-a3a21b29100a", "value": "12288:9g/gIbw8eGGmtiK5oimA0mj4zQ6vcfa1tfzYy:4Dbw8eGG+FoiWXvUa1tcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632220096, "uuid": "0210458a-2e60-4c8c-9ae0-8b1bf733a748", "value": 496640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632220096, "uuid": "404bc00d-2ae1-4521-9c8b-84af2688f4ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632220096, "uuid": "bfa4e845-3782-4bf2-bc97-07bd6ecbe053", "value": "SOA.core.pdf.bit.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f13deb58-1b16-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632254589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632254589, "uuid": "09c99757-4866-4014-bccb-ebb75e08a6da", "comment": "Malware payload", "value": "0299590d4ff9bd834d1470684682ed01", "object_relation": "md5", "Tag": [ { "name": "ASPXShell", "colour": "#8AF4DA", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632254589, "uuid": "78ae6c79-dd02-4b40-a53f-949675d8456b", "comment": "Malware payload", "value": "e5a6aa24d318c7899b6d6407375d491c0cd6437fb7a2e2ab57dcbaf325ed39ce", "object_relation": "sha256", "Tag": [ { "name": "ASPXShell", "colour": "#8AF4DA", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632254589, "uuid": "3f71e96b-9a56-48aa-943e-e03eb3a96604", "comment": "Malware payload", "value": "ea77f0a20c6b9413c16e7dba82944bb5f441fc0c", "object_relation": "sha1", "Tag": [ { "name": "ASPXShell", "colour": "#8AF4DA", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632254589, "uuid": "b2c79003-d59d-4110-9cbb-81c4f5ce2d48", "comment": "Malware payload", "value": "f7c63f3da6f476288702d62d1414ac0560d2c6925c3c8b9309b2aed1ebec2f3c7dbc71b50aee0eaa020365863f9536df", "object_relation": "sha3-384", "Tag": [ { "name": "ASPXShell", "colour": "#8AF4DA", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632254589, "uuid": "66ba1856-cdc4-4280-b224-b1e3a2263236", "value": "T1AEB1C70AB14C490EE5112027E5F38196DA6AE5F6033729BBFD6A173FD85D76C01706F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632254589, "uuid": "32c5ede8-4b1b-4ad9-b14c-c2c87e4a3dfb", "value": "96:jOA1tyHW+nCT0pvkiY2Ut4BVNMztU4PZKjF2/UWt527UW8UAWicy7OAbUloAdo3U:a5HNnC4pvTytvZ3UWtkUW8UAWia8Urdx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632254589, "uuid": "e7f3f442-51ff-4734-87a4-9e7c8bb52138", "value": 5257, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632254589, "uuid": "40cd03c8-0ad2-4be7-b24f-0eaed748ca4a", "value": "text/html", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632254589, "uuid": "6485685e-4633-4c4d-90a7-ee1921ac22a4", "value": "3PqFZe3c.basebash", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "289cdfaf-1a8d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632195411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632195411, "uuid": "aeaf6995-245d-46dd-aeba-0f5a5706bcab", "comment": "Malware payload (AgentTesla)", "value": "d091a99966cd2ad0556558bf6a8c211b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632195411, "uuid": "3577d5a3-6749-4c3b-89ac-883a5cd99a45", "comment": "Malware payload (AgentTesla)", "value": "e5d0bea6ce945bc34b2740bc35a0fa3e6701819cb726aa3582c162cc3c2ba941", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632195411, "uuid": "3946e949-283a-4f8b-801d-aa3fb0ba0c39", "comment": "Malware payload (AgentTesla)", "value": "edcf2b579f691049525aaf5cc52711aa32047651", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632195411, "uuid": "0dd23b71-4f79-4085-bacc-175c2ed4c20b", "comment": "Malware payload (AgentTesla)", "value": "6b02e221512de0b7857e009ef3a0c5f9c035331d6c3f71f24ad6bdcdffc8e350eea92375cfd41a60f330541542b0acdf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632195411, "uuid": "bb6fd0e2-fb5c-47b6-bef2-e1486c1baf04", "value": "T17C158D394D2682F787EEC66CD08C1FCEDAA6A4837B919F1AC496D7C2025770FE48855C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632195411, "uuid": "8e0b87df-95c2-4415-b00f-db86dec00912", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632195411, "uuid": "e817e06a-d93d-4e47-82c9-d5ac0c9da0ce", "value": "12288:q3rtZO4Ax0hw15G/Tpb0HeuXLwSXbMcam5K:4t8x0hwTG/TbtSXbMca", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632195411, "uuid": "6d31aac8-4ab3-4257-beec-454c77a31ddb", "value": 907776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632195411, "uuid": "2aee514b-737e-4e3d-9657-c919eac22137", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632195411, "uuid": "415ab6ec-1da7-439d-bd72-7ffabc650a51", "value": "CONTRACT SIGNED.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01f9ad4d-1aa3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632204795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632204795, "uuid": "f8b3a415-eb1f-442a-9d0c-7e1819080543", "comment": "Malware payload (SnakeKeylogger)", "value": "5cc944d23d0547aad70e9d2199e3ef04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632204795, "uuid": "a4fa4611-5d88-4085-8567-2fe2dc8f8686", "comment": "Malware payload (SnakeKeylogger)", "value": "e6c329ca3efff2d64a73de0483e5059fbf57d57cdb03f4d156f64a932450b140", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632204795, "uuid": "57e1f825-9119-4d9f-89a9-365a7a979f3a", "comment": "Malware payload (SnakeKeylogger)", "value": "4753cfbd90d4eb7da7da40f1342d9f8065c931bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632204795, "uuid": "53ef2eb4-2484-4598-9ef5-588ba7d816b0", "comment": "Malware payload (SnakeKeylogger)", "value": "9e7e995fe06d7cdec2157b4b51a4eb39e162e2ad37981de3ad04640f95cd8c00cf424ffb566c24e1b4334bc9bfa6940f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632204795, "uuid": "76c1b974-daf6-4984-95b3-0be4cee33784", "value": "T1B8B41861156E7D79C0B46B3A47B357E51BEEDC402A3ACB896B21F279003C6D77E4230A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632204795, "uuid": "802a8dd5-2463-483d-85f6-f3a90a3fa1ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632204795, "uuid": "bbff32bb-6c67-4550-b378-9fd74ed4a6d5", "value": "3072:7/bLPOdwVuY5iteXI3X5dkq+dasz5aIG6DyfozdouCiDUg4TznvUPh0kudnd9caI:7/bLzK5alTtFFxLCw4TznyouSmSX7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632204795, "uuid": "e5bbf566-7cba-4039-aa1f-df0f6698f717", "value": 519168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632204795, "uuid": "6da052b6-5a36-40f9-b35d-416e95f1b2f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632204795, "uuid": "c68b9433-756b-4f77-a98d-d34725636945", "value": "5cc944d23d0547aad70e9d2199e3ef04.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2590072-1ab6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NetWire)", "timestamp": 1632213278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213278, "uuid": "81441e5e-ec78-4154-ad38-207fd66a8801", "comment": "Malware payload (NetWire)", "value": "883e5c284fe484a109a58cde48fac13f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213278, "uuid": "819dd0c9-c51e-41b5-a26c-ff6fb5ffdbeb", "comment": "Malware payload (NetWire)", "value": "e6d2ac59b7c3c2002f814c65372948235007b26ae3a4afdd09d2b56a35ce7a92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213278, "uuid": "0b201eca-fb57-497f-99f9-93d45e3a1ef4", "comment": "Malware payload (NetWire)", "value": "c35e6ae09e47df4771fd6b315cccdd280ab9c0e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213278, "uuid": "d24cd97a-d7b4-491d-a2da-8bb1d8a1c260", "comment": "Malware payload (NetWire)", "value": "a169ace8648f48f505bccf1909e0101f5cd4f0981e84cf375a811d56630e1c4dbcfcce35f728bbd656a6176fa5b698df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213278, "uuid": "54bf9404-5ce3-4caf-bb47-294aef29e33a", "value": "T106E37A75B69C88A2ED550235456E8FFD0723AC6DBDA0423F3AC57F1C283C9A09815E3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213278, "uuid": "82a465f5-4914-4f0a-b6c0-980b5af53084", "value": "fa4188eff72633a8208959abd40270b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213278, "uuid": "984dc849-1855-4ac6-93f8-0efe6d767a8c", "value": "3072:fx4vyVVHub54z3eayaKVhn0nz756Fm9vYkYvQd2a:fuvAFy4Zm10z7swya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632213278, "uuid": "bf188565-ea66-45cd-81f4-f009e5aaa93e", "value": 157006, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632213278, "uuid": "939a7281-95cd-4c04-99c4-12a1a2c8df9c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213278, "uuid": "a5a9bbf6-8e13-4411-971d-d12808c644ae", "value": "e6d2ac59b7c3c2002f814c65372948235007b26ae3a4afdd09d2b56a35ce7a92", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6198f4b0-1ab6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632213116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213116, "uuid": "6ee32da1-eced-4adc-a191-97f1b78a70d5", "comment": "Malware payload (Dridex)", "value": "d154706eeec27083ca2f1471791ff677", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213116, "uuid": "08bb5c27-4686-470b-a8bd-18b54cfd396e", "comment": "Malware payload (Dridex)", "value": "e7b8493634d1319d62fe47d27b252923d40bbe29b793f8eb65dea02393052fbb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213116, "uuid": "66abc3f7-95ce-4a30-abea-900bc68a90aa", "comment": "Malware payload (Dridex)", "value": "e28da06cc6b768ba70cfc114166fea2c2415afc5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213116, "uuid": "6b29c98e-3846-4207-856c-c8225349575f", "comment": "Malware payload (Dridex)", "value": "b87f7620e330ea12a7840d506806ade8c6a163f3be4ca5a604830c5baeb638007254809314671dde027eacdf7668312a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213116, "uuid": "5511b1e6-9b15-4965-a92c-29c70bda589e", "value": "T1A185E020EE69E1E6C6B89F3E9408352727F93D75110D608CC392704F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213116, "uuid": "0da5481c-7174-4299-9078-b31bfe26a35f", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213116, "uuid": "7065f247-066f-4f9e-b3ba-0c8f93b116da", "value": "12288:FVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:cfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632213116, "uuid": "9e6b66a8-26ff-41dd-923f-d08ae236b79c", "value": 1814528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632213116, "uuid": "02fdf779-28a1-4b89-9f28-45c911062899", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213116, "uuid": "166bef57-88f7-4346-ad01-6511fe652df5", "value": "e7b8493634d1319d62fe47d27b252923d40bbe29b793f8eb65dea02393052fbb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bacf45db-1ae0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1632231305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231305, "uuid": "62ca8432-054d-48bb-b70c-178fb56ce5e7", "comment": "Malware payload (ArkeiStealer)", "value": "19e5738160c9bda8ebf6cf11efd74def", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231305, "uuid": "3c60af4e-e604-4fb7-9d0f-71e1296ff88c", "comment": "Malware payload (ArkeiStealer)", "value": "e7fdfa40081f076f90db6db92be295768e4f9405acb3a601d0b2cbbe5eae7d05", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231305, "uuid": "fe884db9-5486-4f44-bdff-0a206ad444aa", "comment": "Malware payload (ArkeiStealer)", "value": "58861b86ca69ffe7bf6c8f3e0421d1af548ee42d", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231305, "uuid": "72d30c74-7bc6-4a28-96ce-b1be5ad11c79", "comment": "Malware payload (ArkeiStealer)", "value": "14f5445fc960d25e976c9aa5467188620b320714fa8d8f6e6e4789b2673144be4967cbbe44c1efaaaf2069a3e2529feb", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231305, "uuid": "cd8a4e43-ef9d-4928-98ea-bc162d8f9796", "value": "T1BE448D20B6E0C035E5B741F89DBA93A8A93D7D715B3051CB62D63AEE26346E6DC30347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231305, "uuid": "8da006c0-507b-4dde-beb4-c8be1c054986", "value": "3a5e62b58b4a57118c6dbb55f27570fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231305, "uuid": "2ee8e086-a835-42f1-a6bd-2b483577e68b", "value": "6144:H7zAvGisE66uoLkOkgCmRMPHasWm1WwR/Yz62hWuROsrP:HIsEluoLIvmRMvam5Az/IuRdP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632231305, "uuid": "57567143-c549-4729-8016-c47ea4e03795", "value": 278016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632231305, "uuid": "92fdb723-44e2-457f-b388-e892f97964f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231305, "uuid": "9501eafd-d733-47e9-af10-7478842dda4f", "value": "19e5738160c9bda8ebf6cf11efd74def.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54eb93a0-1ae1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1632231563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231563, "uuid": "763f1f9d-100e-40ec-ba37-f73df17a5cef", "comment": "Malware payload (ArkeiStealer)", "value": "db048d73b970b0bb0d5afd0df79335e8", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231563, "uuid": "4d99a267-641c-44e1-bb7d-a79af8e018ba", "comment": "Malware payload (ArkeiStealer)", "value": "e89d7206e2194c107a9ca50d61f31c86510d1a55c8c7f7e3eb0f2ac3f2aebeef", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231563, "uuid": "cbfe926b-7b38-4c86-a71f-6faf975922d6", "comment": "Malware payload (ArkeiStealer)", "value": "d43fd6ccfeaeecd52aab269144ee02dca7560e52", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231563, "uuid": "c2176b63-cd11-4795-bb0d-7f03ace9c214", "comment": "Malware payload (ArkeiStealer)", "value": "a75c61dfb6cdd14ad1deb893f90bc688ccefd276bd5a2c83f73531cb3e7f1d3d2c52416ea7f7aec5349605318d2fff50", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231563, "uuid": "fbffa217-8685-4009-a24c-0c244d124ce1", "value": "T16824AD113AD0CAB1D99301304B24DBB0667AF8725F2093477A7E7B6EEF243D07A76256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231563, "uuid": "5ebec077-dcc5-4908-86dd-c40613a09c8f", "value": "cc09957b6a7030319b5e28e26ed6a721", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231563, "uuid": "38b8583d-ca09-4e0a-aee0-ab1f5f6ecc88", "value": "3072:cUEW5ynPrEkU4tzfW9BIKnhP57Nm9T02kw9whIxAwjtqAGJ:cUETnDEvCze9bTNATB9GBwjtw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632231563, "uuid": "762442c7-5268-475c-923b-efe12feb283f", "value": 216576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632231563, "uuid": "c0fc1b58-9940-45a1-82c0-2add67dae863", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231563, "uuid": "49e9385f-c87c-45ab-b29d-701b9b50aa8c", "value": "db048d73b970b0bb0d5afd0df79335e8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b373853-1ae0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632231091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231091, "uuid": "0c130866-84f6-422d-82c0-43b7ae2b1728", "comment": "Malware payload (Formbook)", "value": "f92898079644c77d76a03ad969332f03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231091, "uuid": "d859b24a-3a22-497d-a817-cc03725e5390", "comment": "Malware payload (Formbook)", "value": "e911d332af82b2e6fe66b7d2df23b5a9ba0443ea8f83500ae17c6af1f65d401b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231091, "uuid": "4c8fff31-f244-4c7b-8017-9dd68b98ce15", "comment": "Malware payload (Formbook)", "value": "4dfda3116b95639ce0e6afd68a433f12262e2617", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231091, "uuid": "6a025e9e-dce8-4260-80bb-7058084e541d", "comment": "Malware payload (Formbook)", "value": "3380999aa7d051fb5dd50423a179bde121686959401c36bfd4385fb9836e14058357cc67aea9f67409a11e67e78fb3f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231091, "uuid": "a731bcb7-2e6f-4142-ac2a-1930207c2ebc", "value": "T1ECC4014272AD8A14D7DA37B530A6D3413B73BE765973844E2ACD708E4F372814EB4B26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231091, "uuid": "89cd100d-79f3-40aa-90fc-a852370a59da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231091, "uuid": "e39402b1-f806-4c3a-8477-c12416bc1820", "value": "6144:/Ck4FD7MbwN2s7GwNmtiS3/NpZZaaUhdmIk/Y9++o8swbQ4gYiBkrP48pkOoLUVB:DyIbw8eGGmtiK5obDk/C9NisnCnC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632231091, "uuid": "78de8c1b-cec8-42e4-aff2-6723e3adc448", "value": 593408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632231091, "uuid": "ef2d6adc-a4e8-41fe-84a4-124f0219e62d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231091, "uuid": "4fb53770-f1c2-4940-bf93-61a0ddcd9fa4", "value": "f92898079644c77d76a03ad969332f03.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a9ee758-1ab7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1632213453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213453, "uuid": "59697073-4c0a-4cc1-a987-cff2f7304466", "comment": "Malware payload (njrat)", "value": "61cc86c500d27fb8ee7cdcbf3f51654e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213453, "uuid": "459267fe-25e6-4aab-8320-73292857dcf8", "comment": "Malware payload (njrat)", "value": "e921d5f11cbdb49edbc84df43345e162f6c949e717afee3404ca5605c550c69d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213453, "uuid": "115dd7d9-ed82-4053-8042-b56c4550f0eb", "comment": "Malware payload (njrat)", "value": "da823449b046aabc24d82519619235e4800dfd22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213453, "uuid": "03aeeac0-e782-4ef1-a216-926d1f279c84", "comment": "Malware payload (njrat)", "value": "4a100eb9d45d16e7578cc8a02a50892d86695556e32b00f9c55af27f4e564fd0eaad87f88886dbced51a998e6a24cace", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213453, "uuid": "55e3e6e5-1b06-49a5-a208-f4d568010e68", "value": "T12A15AE0373DDC3A1C3725273BA66BB01AEBB7C2506A1F59B2FD5093DE920162521E673", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213453, "uuid": "796a29db-a138-4512-b0cc-0c4cf725d8be", "value": "bbac62fd99326ea68ec5a33b36925dd1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213453, "uuid": "7f5c1615-8c30-41d8-89af-08fbef27029a", "value": "12288:q4lsXvtCcmVVXzzn4PJAahPl/QEdIMiVbHydEIJnJWUgaT7NRq9MmCS:q4lavt0LkLL9IMixoEgea/NRq9MmCS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632213453, "uuid": "81bbfb5d-da6b-45af-8eaa-791da488e4dd", "value": 884224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632213453, "uuid": "5589a8ae-1ef3-4dd6-ae07-25391af81032", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213453, "uuid": "29705aec-3f90-444b-aaf9-bd0244ae52ac", "value": "e921d5f11cbdb49edbc84df43345e162f6c949e717afee3404ca5605c550c69d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9d51c4a-1ab5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (IcedID)", "timestamp": 1632212861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212861, "uuid": "0e2b2d92-11ac-44a7-a1e4-782ceea7c5a9", "comment": "Malware payload (IcedID)", "value": "89829f37c4895709efd79234eb1a3a82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212861, "uuid": "c6e680d2-b3d2-49f4-93d2-7e2a0dc9c9c0", "comment": "Malware payload (IcedID)", "value": "ea0fb0dc663dcb83869c83db63565e8e69a1caac665f789a58b1c98b7ecd64e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212861, "uuid": "05e1fb90-4a8f-45cd-9d57-26559e31c0ed", "comment": "Malware payload (IcedID)", "value": "5dd0fb99f3ae997374f67533b9c8f8da91e9064a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212861, "uuid": "e09626ab-0f19-4cbe-9ab6-c96bf35ecc49", "comment": "Malware payload (IcedID)", "value": "cfd1a508028a5916fc0b8891150a90cc43e67a364fd1fadbe6c6de9a0fe197b250a4863ce4e74ce9bfa00327788b119d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212861, "uuid": "8b79f7a7-c4fd-49da-94d9-deec64aa0230", "value": "T100E5801163F90995F2F32B30ADB485145B3ABDA9ADF6CA2D3144418E1DB6E50FE31B32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212861, "uuid": "837e2645-f35e-43a8-8d79-ef89026dd667", "value": "72c225f94c42f6e831bc36050372bfb2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212861, "uuid": "93b261c8-a637-4c97-8883-2b1185b675c8", "value": "24576:0lhbYoZ3/6oeZCEu8CwrotY9MkeTzL/BU5DB:EJYoZneZe8nstiMkeTnBO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632212861, "uuid": "60b626a0-3d06-4681-ae3a-9d3ac55eb33f", "value": 3149312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632212861, "uuid": "79f8ae2f-4798-40c4-af86-b4a6a55dff1b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212861, "uuid": "cd8e6a76-fba1-4aac-b33b-a0fcb230f377", "value": "ea0fb0dc663dcb83869c83db63565e8e69a1caac665f789a58b1c98b7ecd64e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51611372-1ab4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632212230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212230, "uuid": "18752da2-502d-4916-b774-2f9c632b45fa", "comment": "Malware payload (Formbook)", "value": "0f1934a74a43599921092502f7dc5765", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212230, "uuid": "82e99d67-cf6e-4bc6-85ac-31d270c2d0d6", "comment": "Malware payload (Formbook)", "value": "ea12191fcd49d36b68be2c466a24cac87cfd79f9d1fb18ef252037f0fb976979", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212230, "uuid": "b0ec7385-3d7b-4998-8a91-b13222714cf9", "comment": "Malware payload (Formbook)", "value": "09498733d424af7142d20a0a2396e83cca6ebaf1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212230, "uuid": "67975792-56d8-447a-9b63-3d31b1007e69", "comment": "Malware payload (Formbook)", "value": "a1a18f92f82774ee44e130f713cca80f2ac7511baa355b3ef823a3bb014a94990479d6cf32e86445c721e418f46d60b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212230, "uuid": "b53bf619-83c5-4ca6-a790-b347e6b25253", "value": "T161441226E6D5C476E4965E320937BE36E3B38308951A890307BDBC6F1570CD7C628E57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212230, "uuid": "5900afb7-c913-4c8a-9003-7d49ab9de6b7", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212230, "uuid": "eedfa307-2756-4bc5-8698-7988c0263766", "value": "6144:38LxBkTTsVPB1WCW6ICr4+AJEF0UabELgV6rhhM:x8VZVHIl+n0UxEV6NhM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632212230, "uuid": "1056d2bd-52c9-4f45-9176-aa6187ee6748", "value": 259767, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632212230, "uuid": "1ad8e7fb-2a7b-484e-95fb-48987554f17f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212230, "uuid": "841c93bb-e031-4b5b-b937-24dfd0545368", "value": "098765445678.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91d61192-1ab9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632214485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632214485, "uuid": "cc12e261-6bcb-43b1-ac75-d7d8c5cd63a0", "comment": "Malware payload (RedLineStealer)", "value": "2be66ce2b5cfdfec51cdc633577f0cb4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632214485, "uuid": "15d1af55-ac45-4994-9c10-b5c9ba9cc74a", "comment": "Malware payload (RedLineStealer)", "value": "ebbfcc02fe6c1b6705b1ffddc64961aaba4702fad5495201d594f72086267daf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632214485, "uuid": "95f5d9c2-9cbc-453c-ac93-595100c28b19", "comment": "Malware payload (RedLineStealer)", "value": "baf35c5c0fc89199e61010d2d52013c2d67cc6c6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632214485, "uuid": "5b4c262c-ae79-46d7-aded-27ca7d17e083", "comment": "Malware payload (RedLineStealer)", "value": "9861f32c5822ad0c796663824ccaab1a298ded5bc6cee1f155f7d6e134263605ab1f206f5c83fd3927957c90c77a1a41", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632214485, "uuid": "3fb088c0-797d-4157-918e-28959da3481c", "value": "T181F46C30FFC79F12CAC9377E937F52D303B980E157329207A95A5578681E43AB9C6A06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632214485, "uuid": "cb8c057f-7eb2-4f95-ab1d-512caf2b44fa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632214485, "uuid": "877d266c-75c8-43cf-9746-782ec143fa98", "value": "12288:T3fUPvPE1rzMBJrg6gRmBe1TzHuUwvrtq6bpRw4MrgjKGm0Hs3q+hqOE8FVhfWcy:T3f53TzHDUt/LNMsjE3hqurhecH1o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632214485, "uuid": "3869607c-aee3-495a-b087-dc4cb75e4209", "value": 783464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632214485, "uuid": "3fa1d555-1f88-466c-92f1-d4c74f040d57", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632214485, "uuid": "a40cf411-8df5-4769-bb27-a5b79ac907f0", "value": "2be66ce2b5cfdfec51cdc633577f0cb4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3ede049-1ab5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (WannaCry)", "timestamp": 1632212798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212798, "uuid": "6e850f65-2667-4ce6-9809-e9e34937659b", "comment": "Malware payload (WannaCry)", "value": "087f42dd5c17b7c42723dfc150a8da42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212798, "uuid": "ab9188bd-3d9e-4e8d-8fd2-497c0a1f3ca3", "comment": "Malware payload (WannaCry)", "value": "eceb2f25bac4cbca1da5f4e390124912cd91f541ad1ccada2ae2b46f4aceb414", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212798, "uuid": "726cded4-482e-433d-b2e4-0956abb80a13", "comment": "Malware payload (WannaCry)", "value": "013010ff0e5c25c48b2a4e7ed1340738a0dd8995", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212798, "uuid": "663014c4-2862-4a7d-8af8-8b9f93eee8d4", "comment": "Malware payload (WannaCry)", "value": "41d655d8ad813a594feb219aef2105ce575abf472bcb1e16e8e41d246f76181f781df8eac269699d1a226347b05e0aa4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212798, "uuid": "ec026d36-a9da-492a-b0ab-3830eda40bbd", "value": "T10DF533F4E621BB6CF2540EF54856C59B6A9724B1EBEB5E39CA8005A61E40F3F8FC04D0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212798, "uuid": "52a4fb2f-21ae-4b1d-bfe4-790779a83b89", "value": "68f013d7437aa653a8a98a05807afeb1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212798, "uuid": "06a7893d-1826-485f-8f56-f27d46982891", "value": "98304:QqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2g3xt:QqPe1Cxcxk3ZAEUadzR8yc4ght", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632212798, "uuid": "9d0e7561-5c4d-49f5-8def-ec67d3332a5a", "value": 3619297, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632212798, "uuid": "50e7c8fa-a936-40ee-a4f8-a2d7c06aca4c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212798, "uuid": "c473863b-e7a0-4c09-b1e8-0ac3647095e3", "value": "eceb2f25bac4cbca1da5f4e390124912cd91f541ad1ccada2ae2b46f4aceb414", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f20ec93-1ab6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632213005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213005, "uuid": "e52180c8-f384-4976-81f0-34e2267a1027", "comment": "Malware payload (Dridex)", "value": "c3126ea9a6b72feb2d533f7c5b4034e1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213005, "uuid": "6a4e52a7-8dbb-44a3-8eab-448e8b675a92", "comment": "Malware payload (Dridex)", "value": "ed1abbdbc76042a413091ee9f1284b1268367c49902028a91acd530ab0db716f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213005, "uuid": "6543c3ab-3e26-4c81-a867-9dd66fbf0b60", "comment": "Malware payload (Dridex)", "value": "b02e61b0e0f5c22b22b93786ddfeb8b7189b4ce9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213005, "uuid": "fc45014d-4d7e-4a8c-bcd0-173003c89d9e", "comment": "Malware payload (Dridex)", "value": "1424266ad8fc4c01973aa249707e08c2e83e021e12fb0fefb42be30772f800f8b9674c20865f1ce926d172d472285e9f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213005, "uuid": "ddeb4c6f-169b-4c4a-b35f-6a1d48133a02", "value": "T130A5D020EE69E1E6C6B89F3E9408352327F93D75110D608CD392604F5EFC6546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213005, "uuid": "493c411d-15c9-4fba-a2ee-a5f9ddfe5ea4", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213005, "uuid": "f19b9417-9bb3-4484-8f45-013c2f983d8c", "value": "12288:SVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:PfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632213005, "uuid": "ad81b445-39ed-4672-9ab1-596cd3159dfa", "value": 2248704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632213005, "uuid": "31e4c547-a653-44d7-a9b3-7303de2bb52e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213005, "uuid": "4f6bc410-ee45-46e6-8b10-6e67db0b6f76", "value": "ed1abbdbc76042a413091ee9f1284b1268367c49902028a91acd530ab0db716f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a53f694-1ae7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NetWire)", "timestamp": 1632234042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632234042, "uuid": "1f1ae275-d1f5-444a-8501-37243d350f32", "comment": "Malware payload (NetWire)", "value": "539ef93713ef243b8ef56e7ea9b02fbe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632234042, "uuid": "e276b1db-f311-475a-ad04-0164024eaf02", "comment": "Malware payload (NetWire)", "value": "ed656328aa06c9b766eeb8edc8a692717865812317d7806645bea9c07d31f4c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632234042, "uuid": "1b875dc9-100e-4bff-8e29-cf5ccedc0a47", "comment": "Malware payload (NetWire)", "value": "9e33142cc71a6360d0e4e28a085b38d691a8e693", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632234042, "uuid": "1671997d-07bd-4909-ab56-1bb4350b54f0", "comment": "Malware payload (NetWire)", "value": "645a71493ec8d348bcd4e9eec980aff7481237df28ab402bd2a0f27d453e200cf55b2b4f4ac2f22a96893237beb029f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632234042, "uuid": "cf0d97e3-825e-4285-a63a-5cfa2079c7ac", "value": "T159056C3213427C5AF7A71FF9F9002A620CEE78D79392D42CFA845B6A60AB414DD4DC76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632234042, "uuid": "fb17c5ef-8f87-4001-9f29-6a0c7ed4e123", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632234042, "uuid": "65fd766e-2ecb-455a-96f7-a6647af778ba", "value": "12288:m0oTWHlmvrgnXomQLNxgHAxgUpNzrlpiqycG9zvNBE9gDI/phJ:m07HlmT57fgAp1ji/ZFvNBEEq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632234042, "uuid": "c33f4942-70af-4394-8ece-6c6441060628", "value": 823296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632234042, "uuid": "af5ba85c-3e43-4280-b7ac-515aaed9b8c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632234042, "uuid": "6e560225-cbfe-4437-9490-124d4c125987", "value": "539ef93713ef243b8ef56e7ea9b02fbe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ab0f006-1ae1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1632231653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231653, "uuid": "a2c56969-b107-4be4-931d-02012fa08dac", "comment": "Malware payload (Smoke Loader)", "value": "1c1ba9aab0fe6101fe5981644cfeca48", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231653, "uuid": "4419dbec-1d54-4def-9052-4ab8c3848b77", "comment": "Malware payload (Smoke Loader)", "value": "eeb0579f309f7c084e5b313c4d79106c2ca4f7ea68ff92127077018a05b7c316", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231653, "uuid": "5ffe2bf1-af9b-44b7-a1f6-b4ae3b835882", "comment": "Malware payload (Smoke Loader)", "value": "c32496a11684cc7a680f92a64d036e68bace27ab", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632231653, "uuid": "7e45899c-b83e-4b09-a6ef-223d6bf6bd5b", "comment": "Malware payload (Smoke Loader)", "value": "c5b75eb036d5646c86322a1974a91e20d327e2f6d0c0fcfeebbebd85ef193cf279b5b6cd3f3df14479cf89bcafec37f5", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231653, "uuid": "8e84bb0d-d500-45b6-b996-279ea27d347c", "value": "T12B448E60A690F035F5B712F489B693A8A93D7EB26B3090CB5ED627EE16346D4DC30743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231653, "uuid": "14a5e3e5-a2b6-45f0-a029-12ec10e60236", "value": "3a5e62b58b4a57118c6dbb55f27570fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231653, "uuid": "216b886b-a6ee-4bb6-b234-7db1c8f54d5f", "value": "6144:BQwiRG+2UXcgCcLJO8gC8o8mPoeD2oQUclsAZoVmBHd+OsbZL:Rc2UsDcL7v8o8mwwTNcl7eggj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632231653, "uuid": "c62b6198-8b54-4083-856e-6b595b9f56ad", "value": 276992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632231653, "uuid": "c6965559-abf0-408c-b274-10dc73de9f7a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632231653, "uuid": "706b7257-31b0-47da-991a-b1adbb3bda63", "value": "1c1ba9aab0fe6101fe5981644cfeca48.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0361fac2-1aa3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632204798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632204798, "uuid": "f12dab85-c516-43db-9dcf-0ff838d52a2d", "comment": "Malware payload (SnakeKeylogger)", "value": "0576dfb0def755cf0a4ab06adc78df52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632204798, "uuid": "e5c3a07b-cebf-47be-a062-30e137efbf3d", "comment": "Malware payload (SnakeKeylogger)", "value": "eef48448e3e27b5c0b7eb68420134789b7d092fc3a75b5402d95efcc7d58e02d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632204798, "uuid": "a8ea6b1b-deea-4bd0-be4f-3d043492107a", "comment": "Malware payload (SnakeKeylogger)", "value": "042e8f22a9e7b933fae18e23e0e9afa197610c34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632204798, "uuid": "d4fb0f44-d781-42df-a0c4-b268f9c1e6cd", "comment": "Malware payload (SnakeKeylogger)", "value": "dabc074b8e4299823c291507f55f9779f03968500e5ffa10806dddb20c6399a81c95ed34f31e95e052e0e7b0209ff90c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632204798, "uuid": "4445a0f2-63dc-415f-9936-a23a491991dc", "value": "T1A7B42861256E7D74C0746B3A477317E51BEEDC402A7ACB896B21F2BA103C6D77E4230A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632204798, "uuid": "7d53fb38-c6cd-4e8a-884d-70f438d8ebe1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632204798, "uuid": "887dabb2-1635-4bd9-be69-dc637c9b0aab", "value": "6144:UkgbG05QJ0hE6rEIiX/YXbh6QcgTznyouSmSX7:Uz5g0PEnX8bHcI6k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632204798, "uuid": "1b857370-f8f4-4cfd-aa12-07268672ad90", "value": 519168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632204798, "uuid": "ac5ba3d8-2000-437a-b635-e931344e5f14", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632204798, "uuid": "8dd70026-95cb-4aac-b46a-fcd0dbdbac1a", "value": "0576dfb0def755cf0a4ab06adc78df52.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdb9b4b7-1ab5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632212868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212868, "uuid": "c0454c2d-4e03-4cca-abda-4483b902e0ae", "comment": "Malware payload (Dridex)", "value": "46a04a723c5b3f23a5782a3ee27412d3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212868, "uuid": "d3cfeb12-f57d-4314-9d0e-76ed0d56dd5c", "comment": "Malware payload (Dridex)", "value": "f0324ccc3a7fba04ee7569e7545b5b17c3d6b0196c6e0a1896c4ae9f339fcb0b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212868, "uuid": "bb4e5f9a-856f-4432-bc92-4d4a04ea669a", "comment": "Malware payload (Dridex)", "value": "312279f277c9e5834971714fe5a547382ee4e63b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212868, "uuid": "5f08b7c4-4cec-4c34-b063-f8621fedd81d", "comment": "Malware payload (Dridex)", "value": "e5839b56d43944d2ad0bb3fc8ceda9a0bd12d0ce036e6b89fb2201f2f19a396e1a9b02414c527b06e5ac801c08323211", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212868, "uuid": "7e66218f-413b-4eba-b2f6-81a4115383ec", "value": "T134D5E010FE69EDE6C6B99F3E9408352317B93D74030DA18CC391604F5EF86546E3E9AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212868, "uuid": "1faea706-9e8e-45e4-ab41-cce7aeba69dc", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212868, "uuid": "4097cf72-e1a0-4e89-aa73-3e810af29190", "value": "12288:rVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ14:qfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632212868, "uuid": "ef2c2d75-dd4d-4004-9fda-80186068f4a8", "value": 2859008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632212868, "uuid": "18ba44a9-c8f7-42da-8ff8-704e0001a694", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212868, "uuid": "da6d5bab-67e5-4794-aae2-b6bc1ea577b6", "value": "f0324ccc3a7fba04ee7569e7545b5b17c3d6b0196c6e0a1896c4ae9f339fcb0b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aab0dcd-1aa4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632205373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632205373, "uuid": "13a0cb87-716a-403a-91fc-15a48b05d7e4", "comment": "Malware payload (AgentTesla)", "value": "46b4214955c35593202c7173fb92e10f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632205373, "uuid": "7ba91512-1d05-4850-99d4-3bd889d6a91e", "comment": "Malware payload (AgentTesla)", "value": "f03a1669a3b34feaae0102c1bfd1b7a0520665c6b56dce29bf6018c176ff4a35", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632205373, "uuid": "96ec130e-0780-4887-a1c4-78043071f022", "comment": "Malware payload (AgentTesla)", "value": "6d5e94f48f6a5f94c7f2fc6c05821df15a2e884c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632205373, "uuid": "b3167295-1a61-4225-bc4d-5bc96ae51349", "comment": "Malware payload (AgentTesla)", "value": "22bc0cc46990830749623508e397841909f02ba9070e1e18db1356b9279bc1b34d264e7ee23aed78a922e433ea194d1e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632205373, "uuid": "e7b9386e-0030-45ca-af5f-f2d0bd0c827a", "value": "T1F29423AB5FFAE6104F9152ACD9C1B905D8C1FC591F228858F1FEA13A7EDAC6B01C0D19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632205373, "uuid": "05d07411-5830-4fa0-85f9-88d676839aa6", "value": "12288:qkXJSKSsASGsNmuIlrR2kfBkmVRRUEU3lVZ5tVL:qkX0rb1Qf2R2+3fsL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632205373, "uuid": "9a456df9-32ce-4a5c-966e-b5027cd61ce0", "value": 411950, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632205373, "uuid": "76655339-4a72-4d00-bf32-c4a61489d1ff", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632205373, "uuid": "3f1a2336-4e04-4c02-a5a8-4843d6b7aeda", "value": "sale order.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6a74c8c-1ad2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632225285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632225285, "uuid": "d13e1d59-8346-4700-8b7e-761663d8b4c7", "comment": "Malware payload (AgentTesla)", "value": "2415cdc7447d46788bb3788643ffbda3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632225285, "uuid": "5724a90e-5d48-4c98-b475-6ffb153076d8", "comment": "Malware payload (AgentTesla)", "value": "f042dbe0e5124962ae518bd5e03580036ea90b444da9933eb84097ab18ec2afe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632225285, "uuid": "5caa65d8-e9fc-4f0f-b8cc-a63ff32d53a6", "comment": "Malware payload (AgentTesla)", "value": "41a22f45b33f370286e3529cf2f1aec91840be35", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632225285, "uuid": "d4c2d45a-d2f7-4d27-90bf-7957f8b50980", "comment": "Malware payload (AgentTesla)", "value": "71fe87caa74664ca3add44599b1975a1bc9592bb446ae567d1eaafbcea9f23393d64e8c4dd01e1889e97b4743636f56d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632225285, "uuid": "f3788490-ac96-44cb-b5fa-c5c3c16780ce", "value": "T1B8C423AF416B0A0A3EA16BECD427CDBBC5C3082B50F96D9675C246B4BD3D35189CB361", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632225285, "uuid": "a132dc84-d597-462d-afa8-02e90c4cff4d", "value": "12288:On1dBUhiTh/TRcVEE08pZuDimFU7DB/Zr20oROvW6j2QQCN4zwsWqat:On1dBFTRcVEE0GZu/Fwo0QO9Ft", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632225285, "uuid": "a3952f32-0beb-4eca-9f13-c00ede4fe8ba", "value": 574193, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632225285, "uuid": "8a1dafb3-c90a-4fc0-a08d-42aa1e6cc702", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632225285, "uuid": "f4c903e6-3889-4a3d-970e-4ecf0d696d11", "value": "RFQ21-09-21.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb083076-1b1b-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632256726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632256726, "uuid": "b272e8e1-9e1a-4059-89da-9fd490164e6b", "comment": "Malware payload", "value": "2c7d4e78f74cc716f23492ad19daf763", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632256726, "uuid": "b210b3bf-ef6a-4aa1-9018-40d9d4118589", "comment": "Malware payload", "value": "f06b116d8af2db4ae345ed7c9596865c3476d401ff7d52b0a45478847f053ff1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632256726, "uuid": "cab01b54-2c60-4d36-bf70-91385327307d", "comment": "Malware payload", "value": "6ef7bfe52f66fb204b401aa7d280df124f3fa0e2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632256726, "uuid": "595a171f-052c-46fd-a994-964dca189f9b", "comment": "Malware payload", "value": "99217c26cba98d66d0fb6bfe49011591c0c029b7a9d370248a5820b393ef6499b63e88706b390c171efdb294d7ec0547", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632256726, "uuid": "cbd4ae89-712f-4976-8069-4781c1901b03", "value": "T14203C618F2A0DE22D2DA46B39E97E14413B1ED078916C99F67473F4F3E7238D4A9A740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632256726, "uuid": "fcecc00c-50cf-4321-8baa-c12d9ba4d97d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632256726, "uuid": "300f0067-c3a1-4be1-83e1-ddf7374fed2f", "value": "384:XsaVpB4B6pAgirW/iEtpWhsb9bP4spUSjg/XlNo2pffZS1:9jBM6pA/8RwsbWutuv2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632256726, "uuid": "1653dccb-fd82-40ed-9e8a-8d9972ece902", "value": 38400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632256726, "uuid": "1036bc31-ff84-4e71-8f89-218b9af55711", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632256726, "uuid": "e4f9eeb1-88bd-4914-af1f-ec7e1a2ae6fb", "value": "2c7d4e78f74cc716f23492ad19daf763", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12d90e84-1a9d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DCRat)", "timestamp": 1632202247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632202247, "uuid": "48dff3e5-982b-4fac-9137-e3687277690f", "comment": "Malware payload (DCRat)", "value": "a3cfba982fc874f56b2ddd4e5edbc83c", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632202247, "uuid": "881d9daa-3610-4fbe-975b-dea0753972bb", "comment": "Malware payload (DCRat)", "value": "f0ef57425f16ee9d8c5b8e8b33612d8bd1897981436e29761eb8d036146aff98", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632202247, "uuid": "a1406917-05f5-49c3-af5c-92c84ae0743d", "comment": "Malware payload (DCRat)", "value": "bf41d28b8ccd95040501272ff66eaa5d213133a0", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632202247, "uuid": "99d28d61-ad2b-4fdb-b4bd-274fc4b55568", "comment": "Malware payload (DCRat)", "value": "4b5f291a60cfe62044465004c346a988162da9e51ab14a29a91d51b511d402763ef19c3d273dd90c9b5e64adbaa55662", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632202247, "uuid": "d3c8be16-94e1-4500-bf3a-16e6ebce635b", "value": "T157553ED227F52D18F2F74BB47AB429E8657BB9331971854C283731460A3EF91B901B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632202247, "uuid": "3e373c7c-a450-4c7b-85d5-429734598af8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632202247, "uuid": "1ddeb33d-b3c0-4117-b185-fed6104613a0", "value": "12288:WyDWXEtIuNbJAH4MdR838UE9wOsqE2On3LlKRJRJpkd2hZM/f:y6VAHY893BJpkd2hZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632202247, "uuid": "f996da3b-b467-4cfe-b1af-b77da7331e58", "value": 1394176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632202247, "uuid": "417aab23-19c9-46e3-bbee-1b9f56b0304b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632202247, "uuid": "689086c4-38df-4965-8633-da6f5d60f520", "value": "a3cfba982fc874f56b2ddd4e5edbc83c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df92f373-1ab5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Solidrat)", "timestamp": 1632212898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212898, "uuid": "80001398-1253-4f93-a5f3-8029fd5ddabb", "comment": "Malware payload (Solidrat)", "value": "1a2fb161244422b3c97acada0784f2f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Solidrat", "colour": "#AA2519", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212898, "uuid": "2a15df9c-a7d6-4881-82d1-8cd4f75a56fc", "comment": "Malware payload (Solidrat)", "value": "f148c3867fabd68f2c4b43713d9856c0b5a861442404809ba5fa26357751c3cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Solidrat", "colour": "#AA2519", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212898, "uuid": "b93b4a0a-d6a7-4764-ae84-706be92b8030", "comment": "Malware payload (Solidrat)", "value": "841aba2c5bfda3d442ae5d354e9b4361235fcc41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Solidrat", "colour": "#AA2519", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212898, "uuid": "909b2b01-3148-4a00-a990-874a1dab9bbd", "comment": "Malware payload (Solidrat)", "value": "62e53b85b7a98d9c798764d2860242f24c36d0ccee12819f7ad8184115b6d570fe7cebdf47d04421ea78de8ecbc2116c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Solidrat", "colour": "#AA2519", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212898, "uuid": "e49b7158-28e5-4883-94e7-d54d367c879f", "value": "T176C5025C50493CAF955AC96B87ABB82B50E67F21850BCF3604630BF70AFEE917712178", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212898, "uuid": "6c2216f9-43b7-4e1c-bf94-2c8436f01045", "value": "791885170f08fb9c4e327831ff618d49", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212898, "uuid": "dbabd9c0-2bad-4614-a513-62ab405e9ea7", "value": "12288:qCMYGmkOqYYf01bInqzHWI9WFEeapp3TXn8YoWSXLGzEoqAb8/DjUHhsAennZ5/Q:qCmIYSbEDJUrTDw6aZWjvFtta8BuOz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632212898, "uuid": "e1005574-f93f-4ae8-a225-fb628da5dc77", "value": 2714931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632212898, "uuid": "6ab6a9e2-352b-4027-ad84-86854094253b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212898, "uuid": "25b8501c-8e3f-4660-aada-f59f5a5d887d", "value": "f148c3867fabd68f2c4b43713d9856c0b5a861442404809ba5fa26357751c3cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51800688-1ad0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632224256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632224256, "uuid": "a2a213ff-0930-4ef2-84bf-667b88282eb0", "comment": "Malware payload (AgentTesla)", "value": "fad50b0222603a473058d144a68b2ecd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632224256, "uuid": "7f767304-70dc-499e-a45d-2e1d45cdabf1", "comment": "Malware payload (AgentTesla)", "value": "f2482d7e09024d0e0c2c9ffe3d141cde643d9d2c61e3d2c8505e34d0fea1aab6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632224256, "uuid": "1a720950-92ae-405f-8781-9fa0d7324bc8", "comment": "Malware payload (AgentTesla)", "value": "53290e61fb172b6fd14919226acd6002baab4a5f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632224256, "uuid": "a0104571-ccda-4f0e-9778-79bffc8a9423", "comment": "Malware payload (AgentTesla)", "value": "eefb45335c60f67a23497bf7bb05fd0f14366e9f96576872a3ad6d0d4a64d813fd7f85d9dee247391bf1b26fff5c2bbe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632224256, "uuid": "a2ab7985-77f0-44d9-9caa-517f9ad9f352", "value": "T169A4237FA80ED1AD982E6AB1344FAF70C277740184C116D749825CCE9BDC153ACADBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632224256, "uuid": "854ae27d-9f48-4578-8804-8b7452d15bde", "value": "12288:CajivFT7cQ2b3lZOeAxAPwP5c/Tfl0XesXl+u9bMucu5Kg:VjM2zlwxAPwBc/TBvu9bMuc+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632224256, "uuid": "ad5c5506-239b-4690-926d-133afbc81b26", "value": 455238, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632224256, "uuid": "1b974570-8b8e-411e-9b9f-5945f3d7270d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632224256, "uuid": "51f13f4d-092e-42ae-8593-ff99ec3ec73b", "value": "SHIPPING ADVICE.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11974bca-1aa3-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632204821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632204821, "uuid": "478759df-aa6d-40bb-a9a3-4c2636b61de7", "comment": "Malware payload", "value": "213891df3026659112874e2b4ac0045f", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632204821, "uuid": "790235e8-5727-4266-a981-30403c8f4ff6", "comment": "Malware payload", "value": "f2a714c0ef53b8d0d0bbaca3daf9618701d5ae0b9659ddb4bdef1fa36f6e1876", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632204821, "uuid": "ddc40a53-751a-4856-b752-220adc367d75", "comment": "Malware payload", "value": "a8b3db83c2ede25f6deea83d58230ce69e0c76f7", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632204821, "uuid": "cc8f02cb-d891-4ed6-895e-669ac2d5ccb1", "comment": "Malware payload", "value": "7cea962cd46ba5a9c743054326cab9303f0a0c7046db3b27135872019c176016e95ca5f1b2e50b7041811b6a462dd0a9", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632204821, "uuid": "186cdf0a-53df-466c-b47b-832201c3ee9b", "value": "T135566C12B388913FD0671A3A496FD694983F7E612D328C5F5BF83D8C4F356406A3A64B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632204821, "uuid": "a82e49db-a2d6-40a5-a82d-705186e68c12", "value": "98304:2jG8GHGneoZXipi98LTVZ+h5/B25ji09MJN0N2rSQQMktOY7A:29GADhcTZ+hH25jAntst", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632204821, "uuid": "e0f9dc37-8a4b-4e07-8598-033626830fa1", "value": 6376960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632204821, "uuid": "390bde78-f08b-4d4e-8eac-521f9a58f8df", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632204821, "uuid": "fd518b0a-19cf-4164-a258-3fa9306d0cca", "value": "Correos_Pedido-TPAUEFBNQX4TX2X.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "397f8089-1aea-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632235383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632235383, "uuid": "a17e2369-4302-4644-a2b9-b0dbb2e6bafd", "comment": "Malware payload (AgentTesla)", "value": "07a6157b0c4e67d0cc7b911af53963f1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632235383, "uuid": "2e8eed8a-895d-4b4d-a99d-a237f0aca45e", "comment": "Malware payload (AgentTesla)", "value": "f3285a6428db2448d8133c3caa3815148f41b25a2af7ad87d1ced24396c56c2d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632235383, "uuid": "b1ddaf9e-56dc-4a42-b53f-8c485a874e63", "comment": "Malware payload (AgentTesla)", "value": "6420423ed1251d08cff6d34c142e93f1e46671b5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632235383, "uuid": "85883d28-7b5f-48a9-a482-0f5dcf0cef22", "comment": "Malware payload (AgentTesla)", "value": "26ebf329b89a1d596cdd0f16c2c6abc7bdf235a3dc66f2989fe59e004fe975099fdca545f9cc39253a60f4750d3c8f39", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632235383, "uuid": "06f32ee6-7c76-4789-b92e-76d5072ff94c", "value": "T1A2C4223EC2607B74D91ECB7F1021556A4FB1B1877A12E26BAFC2B09A7C537918061DF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632235383, "uuid": "ea8fe939-d007-4e80-a0cf-9c4af710e2c7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632235383, "uuid": "8f5a2b43-d835-46f5-9055-aafc00d1ff1a", "value": "12288:Lt47mtiK5oBkU3C4O9hb4fcagrhu0QQcCyZaxJ6zg171x:W+FoBkUDOrsfcag1u0aRuXn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632235383, "uuid": "e1d4f5cb-6fa1-4ee5-8eef-3433cae12108", "value": 579072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632235383, "uuid": "63221c6d-2630-4a0c-b58c-6a29b76cdf6f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632235383, "uuid": "a87fcb4d-1ddf-4782-8d2f-ec0e9a37f6dc", "value": "07a6157b0c4e67d0cc7b911af53963f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "361838bf-1ab7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (MassLogger)", "timestamp": 1632213473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213473, "uuid": "6130ed4e-e1cb-443b-a3ec-cd2c487cdde0", "comment": "Malware payload (MassLogger)", "value": "7f9cf798b7f3731f9b45fcc6725c47e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213473, "uuid": "4ca5044a-f2fa-4064-a4ba-711344f86b8a", "comment": "Malware payload (MassLogger)", "value": "f4976b0e97222698e5426b45314ef8eeb862204a5c6e1061617d377924dc49b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213473, "uuid": "7277ec97-746f-42a6-a293-9cf9b23ca336", "comment": "Malware payload (MassLogger)", "value": "4caf3a3d1a8d36345d38afb2f8687141c1874382", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213473, "uuid": "44e1cef3-424b-43ed-ba65-070adc01decc", "comment": "Malware payload (MassLogger)", "value": "e43393d8985ce3ad67dfaaae489f6e01b580511e481d9a03f6909bc806e2ceab7a99641a245293d89e402bbaa7b5a244", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213473, "uuid": "824126b1-e1f6-4401-850c-e439aff4de9c", "value": "T150252A14F7E855A5F06EBF30747094054A39BE43697DD74A2BA6A1890F7B3808CB1FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213473, "uuid": "94ce150f-9016-48a6-865a-4b9879c825d6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213473, "uuid": "3468b66b-bbf1-4ccf-bce1-99714c1e19e2", "value": "24576:1KkdueXjq0OQKc2YSEegpQRDLusJLK1lk+oL2:0kdueXjq0OQKc2YSEegpshk1lk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632213473, "uuid": "c8a392c5-b8c3-45b4-bf28-2744de53f466", "value": 1006080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632213473, "uuid": "dd42fb06-925a-470c-afaa-afafccf71bbc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213473, "uuid": "838aee1f-d681-4820-abfa-21c26f870501", "value": "f4976b0e97222698e5426b45314ef8eeb862204a5c6e1061617d377924dc49b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12087d5c-1ab1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632210835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632210835, "uuid": "7d1979f9-5176-4e97-a420-3df92a71bf37", "comment": "Malware payload (SnakeKeylogger)", "value": "765a95dde0d971fb45e31482c140d9ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632210835, "uuid": "369542e3-df2d-4bbc-b22f-284333ca319f", "comment": "Malware payload (SnakeKeylogger)", "value": "f4d49477da58d63b23cbcbfcd844513de19e745f97fb88de4c2acb33d4f5d718", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632210835, "uuid": "ea2dad7d-29a4-4b06-84f9-a37fdde4ba73", "comment": "Malware payload (SnakeKeylogger)", "value": "6544fc385228e32674aa83aa7ebb710bd10aee62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632210835, "uuid": "edb53f9a-43d8-43b9-b18c-b8a22e9431b9", "comment": "Malware payload (SnakeKeylogger)", "value": "f1da7ba5657bb1dd59d0a0b4fcf2b4ee391b18819bd413ac73e5139541ee0f685b0b4f1a447f228aae06cc1243007a98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632210835, "uuid": "f01d8948-e906-4b8d-965f-3c3ebee11c66", "value": "T1A9941846EA804584DC3D6B74243E8D24961BBEFEE8B4A14E2F8E763577F31E3143614A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632210835, "uuid": "27c9a67f-1273-49cc-b41b-b4d63b3388d5", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632210835, "uuid": "440d613d-5eac-45c3-90e4-6f195b01636e", "value": "6144:A8LxB60+uhQMg86tI9R0ZqLmOwZW7huq06KthU9d/Qf3cK+QM:t+uhQMgfCnf5yfJ6KtaPu3cKa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632210835, "uuid": "25c75b7d-0517-4313-b50a-aa9812274767", "value": 411651, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632210835, "uuid": "78ed55f8-5e3a-43df-ae66-a977dc8ac22b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632210835, "uuid": "48e9ad56-6d52-466f-93ed-43799be590b8", "value": "Orde Baru #86-55113 ,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f3625e1-1ab5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632212763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212763, "uuid": "995a0727-f776-46e9-b6ac-9942cfd755eb", "comment": "Malware payload (Dridex)", "value": "489b2a957a21d3baa6215bbaebdd27e9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212763, "uuid": "99b2332c-7b9f-4d01-b5b2-a27e6a4a676c", "comment": "Malware payload (Dridex)", "value": "f4fad363f0997fbbfff2fc9f073313e3735ee4f2e55f3165b6100e537bad87dd", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212763, "uuid": "50e43686-ee1e-4dae-8df4-5749abd2f5ab", "comment": "Malware payload (Dridex)", "value": "f779a8082ac2d19a38f9bf44eff4744001ad9b40", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212763, "uuid": "4f203000-4323-4c2d-9953-3a0f7311c1d2", "comment": "Malware payload (Dridex)", "value": "0ff328ad25b97cf72ba8eb48e06c84b4a0221fdc72502713cbdfe092abbac6ad3238b8528228a1b7c504c2a77989556f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212763, "uuid": "2f6c4199-7fe8-4a11-a77a-59af3a7d294b", "value": "T1C7266A10FFF205C3C09DF739789D3415B2B3AA65811F8A1D824F131E6CA5B912E6E99B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212763, "uuid": "5c292b0b-2f30-4f8b-a741-60c5479af0e4", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212763, "uuid": "5b8aacf3-da92-4321-ae9e-050809888c57", "value": "12288:HVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1/Lb9K:ufP7fWsK5z9A+WGAW+V5SB6Ct4bnbH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632212763, "uuid": "50ec5637-724a-45c5-bce3-9f0808e55679", "value": 4542464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632212763, "uuid": "1d2fa1c1-ea3d-4eac-93cb-5d544507a3f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212763, "uuid": "32e10a00-7e12-404f-94e2-608c27b47f7c", "value": "f4fad363f0997fbbfff2fc9f073313e3735ee4f2e55f3165b6100e537bad87dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24fc5258-1ab6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632213014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213014, "uuid": "6caaaa0f-a36b-437c-9343-b225cf61976f", "comment": "Malware payload (Dridex)", "value": "d8199b164fc58195e661d486425bfc46", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213014, "uuid": "fe4bcb96-7d5e-49e8-badf-be60f9f59d59", "comment": "Malware payload (Dridex)", "value": "f630123865e98db1cd5ee8ea7eb4ae8afd68b377e1c7579d11437e0f982fc67f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213014, "uuid": "41b9bb5b-4bb7-4b4f-a41b-deb3723bcd28", "comment": "Malware payload (Dridex)", "value": "1d4f91022677858b6d73f313f3f6b465fa841465", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213014, "uuid": "400e7bec-fb4a-41d6-8b6e-81a523535fa3", "comment": "Malware payload (Dridex)", "value": "3f66c7a7770273ccfc25d89c426dc78990cd79f0669bac24a84b51cbed05aa78bc8aa3303b6b14a6e2b27decd818ff13", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213014, "uuid": "74785504-16b9-4945-91b3-d93daf90ecc9", "value": "T1D8A5E020EF69E1E6C6B89F3E9408352727F93D75110D608CC392604F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213014, "uuid": "c0bbc701-71bd-4e9a-b05c-bf077c23945c", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213014, "uuid": "a74ec3f0-d221-45d9-bf0f-0c9964d10f1b", "value": "12288:mVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:7fP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632213014, "uuid": "81db445e-a462-4938-8d28-9609090fd5c3", "value": 2224128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632213014, "uuid": "6ad1e37e-9a49-4d10-9dcb-8f01f75e5e24", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213014, "uuid": "119cf38e-4a47-4dc7-8b3a-b2feee3c6d5c", "value": "f630123865e98db1cd5ee8ea7eb4ae8afd68b377e1c7579d11437e0f982fc67f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3632e47-1b0c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632250244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632250244, "uuid": "095114c5-cdd7-49b4-b577-84b122580cd4", "comment": "Malware payload (RaccoonStealer)", "value": "bf268acf14e5a9fd75e3829e02ca0e43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632250244, "uuid": "b551eacc-a7f7-498b-bf7c-72171baf87c0", "comment": "Malware payload (RaccoonStealer)", "value": "f6fd32309de31db16489c5aee61ed853407c071488503c27537b82346db81911", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632250244, "uuid": "f90c4ea4-c38a-4a97-9c0a-88c97402a39e", "comment": "Malware payload (RaccoonStealer)", "value": "6628d104bd9cfc445db4718f274a21806b1e6c12", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632250244, "uuid": "126848ea-6fd9-4999-82c6-5f5f87f3f851", "comment": "Malware payload (RaccoonStealer)", "value": "f28edc7cac3e4deee80beafccae7dfc3817fe0958ed20a98665e91b44145d3b9ffca3f8fbd2eee3f613a812704b8e738", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632250244, "uuid": "555c58ec-ee19-4c43-9d87-e666d894cbeb", "value": "T1DEB4E134A6A1C035F5B712F859B587B8B52D7AB0AB2050CB63D11BEA57382F4ED30397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632250244, "uuid": "3a5c0703-8adc-43e3-a5f0-b9b4df46661d", "value": "833c872ca96c916993b47bb14cf52c21", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632250244, "uuid": "2c7e88e7-88c2-498d-b1e5-061c63aa3a03", "value": "12288:iTmrijH/ixNaaAReukBujMZyKRxO2Q+QUlEDlA3EfM:xYH/ixO0FcjMZyKRxdQ+jlEDlAp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632250244, "uuid": "04d0e148-d8af-4264-a10e-1adb2b17fa4b", "value": 510976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632250244, "uuid": "1c733c72-3b3d-4573-8f8b-893a829e7700", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632250244, "uuid": "91f80b03-ab76-417d-b948-9c203337720a", "value": "bf268acf14e5a9fd75e3829e02ca0e43.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad4b5646-1aa4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632205512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632205512, "uuid": "3d97b884-10b6-4510-910d-dbf55556c69f", "comment": "Malware payload (AgentTesla)", "value": "97866184fc5eced18e2ce88fd9a88bf3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632205512, "uuid": "7e969390-25ef-45ea-ade9-b99d3a49d748", "comment": "Malware payload (AgentTesla)", "value": "f77ddb30ead26d37a5aed2017ab91d9d1fc50a869196dae57b0ba09acea352d8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632205512, "uuid": "6f521836-daf8-4041-8d8b-7e6f4798ae93", "comment": "Malware payload (AgentTesla)", "value": "f109cc1ae34b7b66bc36c7e900338aaa5630ba2b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632205512, "uuid": "962924af-559b-498f-a0da-894ac6324b6b", "comment": "Malware payload (AgentTesla)", "value": "28744c24b97b04e3905a6144d657337a34286eaa2d7470ed6e8d8801d986a2340f0dacaeb8639f8d9e242d47a03134b4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632205512, "uuid": "df92acf6-64ea-4df3-bf5d-1782c366c774", "value": "T1AB05BEC13D47D89BF4DF2AF3986FC12011656E9D9161C73D2692BA2B55F330230ABE4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632205512, "uuid": "6fa7ba86-838a-4df8-bcf0-cd7ae3084a41", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632205512, "uuid": "7858f313-2f42-4416-a5f6-a6142cac4695", "value": "12288:Y5MTdjWjub4smtiK5oyZnGq43fMpKoOsZNo9n9/w7b2hjvo83dsD/RfEtmtId4vU:Z9bv+Forq4UsMil9/w+pgpZXtIdHoO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632205512, "uuid": "fb089886-7e92-48f7-b24b-98475776b11c", "value": 857088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632205512, "uuid": "ca0f70cb-0f6c-4d57-8eda-ecbec83e1d6b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632205512, "uuid": "24a48423-24dc-42f2-b32e-df9d0b166284", "value": "Transferencia de borrador.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44e9f96c-1ad1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1632224664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632224664, "uuid": "b56e5231-a544-4d19-b41a-f5016e326891", "comment": "Malware payload (Loki)", "value": "8d960489e9ee1eb1fca0c3ce9c70a348", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632224664, "uuid": "62b5f6b3-4bb4-445d-8656-ee4fa01e8a44", "comment": "Malware payload (Loki)", "value": "f821c874dab9b173d30b4c76d168c28d90ef53c34c07c878712b1a63d1687130", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632224664, "uuid": "644be2f8-0e9f-4c50-a3a4-af08dc70797e", "comment": "Malware payload (Loki)", "value": "cf9276fce84129d1df58288286ac62285d2b4435", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632224664, "uuid": "fec7544c-6604-4185-9ee7-e3358530163c", "comment": "Malware payload (Loki)", "value": "9a99ae1fd4bf4bacd6472b450e811544dcb76a5a02d8a811ef70734855b0625522e117655269d56a1bd9b208dcc932ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632224664, "uuid": "aa33aaa6-fd57-4166-90c6-291e4e60858e", "value": "T133B46B2233D46B68F4BDD3306038514487F4F807F725EE9EBDDE50C90AA2F85976A626", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632224664, "uuid": "aca209dd-7397-45ba-bb43-b6bec8299cdc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632224664, "uuid": "e0fa526c-a2f9-47dc-aecd-cb7272b16193", "value": "12288:VZiccB77hZAb3hAH6bKX3sQliIb1q04R:3cN7hZAb3hAaWX3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632224664, "uuid": "25255918-2556-4b04-b1b8-d106928debd2", "value": 513024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632224664, "uuid": "03a162c4-d0c6-41b1-b8bb-e9c10eb4d0e0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632224664, "uuid": "06f93e80-5012-4da9-b071-0876eb24bdf6", "value": "company-catalog.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "818b902f-1ab6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632213170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213170, "uuid": "67c5d293-0a35-4972-b2d5-56c9596cc807", "comment": "Malware payload (Dridex)", "value": "f36964b54e497011da3d44f8acfdb4ca", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213170, "uuid": "a25c8928-c815-4214-8534-029198b8ecae", "comment": "Malware payload (Dridex)", "value": "f89633e06ad4665c2382238fe420daebcb116d8f26b16a885b34c68bb3a43fb4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213170, "uuid": "cab9a25f-8721-45d0-89c1-a0c96db8534d", "comment": "Malware payload (Dridex)", "value": "b7c7a99ebac8d2dbfcc8401734ef0081c71208ee", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213170, "uuid": "41d62a30-4297-419f-83a9-9e7af8bda784", "comment": "Malware payload (Dridex)", "value": "e49760f6175eee47af556b8f7a573e57434b29b7d834737df62c5d99dfd78e07218bc1b5431baf8d1b13e7e35c566b28", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213170, "uuid": "0a5b0bb2-c29e-4917-a961-4b415e5eac3c", "value": "T1E085D020EE69E1E6C6B89F3ED408352717B93D75110D608CC392604F9EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213170, "uuid": "9f49115d-5ba9-4dc7-8691-e45e70795250", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213170, "uuid": "c823a046-2edd-42f4-8ef4-0adf65236fc9", "value": "12288:EVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:hfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632213170, "uuid": "f61d8a2d-70cd-40cf-91a4-4545ca149435", "value": 1728512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632213170, "uuid": "d30ed371-248e-4516-90a1-2f68e1b56f26", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213170, "uuid": "1d1804c9-b20e-43ac-88b5-668f2c3c3c71", "value": "f89633e06ad4665c2382238fe420daebcb116d8f26b16a885b34c68bb3a43fb4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86f50eee-1adb-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1632229070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632229070, "uuid": "f87bfa55-ce8d-48ac-8572-2798069a7947", "comment": "Malware payload (AsyncRAT)", "value": "ee37b5c05c6c45e915b8eae54faa23d2", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632229070, "uuid": "bc4bc656-7c74-47bc-970b-740ece706e6f", "comment": "Malware payload (AsyncRAT)", "value": "f8fb3109639b476089103cd8a0afe01d3f015453c25ecb4f46bf1be8f8b04579", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632229070, "uuid": "ffd16a0d-3391-4c5c-81dc-0058dcbdf3fe", "comment": "Malware payload (AsyncRAT)", "value": "e916e2f4470d462d9f141e642bdae3bd7b27b50c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632229070, "uuid": "9c761c4d-dabd-444d-91a6-9459352bed9a", "comment": "Malware payload (AsyncRAT)", "value": "4853614c9d049e1331e094276db5ec64e451207f048bd220172b31dcea4c18b492cc5998b4806538699ca59f20e5a7dc", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632229070, "uuid": "88bac6b0-af7c-4301-9b86-56f74fb5be60", "value": "T1BBF328117686DB13CD2A353A0C62259473F7ABC73763D64B3F8DD6BC895278A4B1C222", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632229070, "uuid": "d2b8993e-0496-4cab-9f43-9cd7af7d0a61", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632229070, "uuid": "1d724be8-3108-4e5f-bcd7-e74524f93930", "value": "3072:zdsbRjH0ScSqHXHSKHSgyWZYrbpVR9xYi/da+1Ev:5sljH0ScSqHXzzSrbpVR9HdI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632229070, "uuid": "a899b257-dc1e-452b-88cf-769f17de4e43", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632229070, "uuid": "065dc783-33b3-49f0-b275-18166e8c16a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632229070, "uuid": "6ac62415-a395-4e12-881b-8d864941a364", "value": "Payment Receipt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed77e1d2-1ae7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Quakbot)", "timestamp": 1632234396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632234396, "uuid": "0d406c8c-1a29-419c-bfbf-f26591e82ad3", "comment": "Malware payload (Quakbot)", "value": "165c250f28360572ddb64e65d494fb22", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632234396, "uuid": "33e6d5b3-ce1a-4e5d-8c7e-dbdbbeb7b204", "comment": "Malware payload (Quakbot)", "value": "f993bf5d2a9f0ea96c372e8fbd250cb1c93519cb6a02457511c43b69cf2758b1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632234396, "uuid": "5999e9ac-27a3-4008-822d-73397d7f5b9e", "comment": "Malware payload (Quakbot)", "value": "a1931674965657328a38d7c886c83c594aab8d35", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632234396, "uuid": "0e4d16af-923c-42e1-b76a-b55d5d209824", "comment": "Malware payload (Quakbot)", "value": "aa9c4b7490aa23a84b1ba8d3104d8c6d0aadc488b4578abc5d7f19afd821712fa0e833091308d3c26aaf1d36c6e4841d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632234396, "uuid": "8cc346f5-8ecf-462d-a5c8-ff5bb860693c", "value": "T1C8149257A9058AC3E51C93F8BE434ED92F066F08E9563EEB21153F8A7F742530D8A11E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632234396, "uuid": "d59cf0dc-f646-4c55-8217-898af5328179", "value": "6144:AKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgOSrofSHq8oD5q:Y1F55q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632234396, "uuid": "d71c9ec4-3dba-47c7-bd1a-ed2088dee034", "value": 203776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632234396, "uuid": "06938ce4-41e8-4c61-97eb-e38e092b269a", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632234396, "uuid": "aa0e20b5-a51a-446c-971d-426a810a6532", "value": "Payment-622945209-09212021.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "214700a9-1ad2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Tofsee)", "timestamp": 1632225034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632225034, "uuid": "1a84ecb8-82ec-41b4-9d33-f32d2879ab65", "comment": "Malware payload (Tofsee)", "value": "887b5822eeccfa021b455e20963ca801", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632225034, "uuid": "389f89ec-93ea-4639-84f5-46a5debd2548", "comment": "Malware payload (Tofsee)", "value": "f9a8afdccfeca1e80e4e695cc01a288b9aa7efcbb08a514ea346c9cfa9742cdb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632225034, "uuid": "f1423996-aee0-44b5-b27d-54aa4bcd1318", "comment": "Malware payload (Tofsee)", "value": "19ca9b0c5e0f655f041b1f752f40b0c73ee12a08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632225034, "uuid": "d6aa439a-62e6-421c-aa45-d9c75596194d", "comment": "Malware payload (Tofsee)", "value": "df4ab61b39f060acdb9842e7c87731b960a1cc74e57c866c384d5f70d9d193199b746223362421ddd8360feb4be0a5c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632225034, "uuid": "51707f9b-1a8c-4883-a882-7e456ef7e788", "value": "T1BC14BE0139D0EA71D567F5704B60DBE22A6AF8315970C38B2B57376EEF342913B2634A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632225034, "uuid": "13ae9f84-9915-486e-8f90-dbf1f0a1e522", "value": "019bced73b51911db702af2d47c34cb7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632225034, "uuid": "081a0345-2b09-4721-9745-6381aed2f2e7", "value": "3072:7n7B5nTbd/4hNqISLs+ehTQ5Wbzm9TSHYX9NOdIxAwjtqAG8:rx/4hNWLteZXATSu9NsBwjtw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632225034, "uuid": "53d60c95-5099-4fd8-b729-77fc0076c789", "value": 204800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632225034, "uuid": "f1db97ae-848b-4ab2-be04-4a8b8865b4d8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632225034, "uuid": "e9843d3e-f414-4131-b0da-f0277633af09", "value": "887b5822eeccfa021b455e20963ca801.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11d8466e-1aeb-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632235746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632235746, "uuid": "04b28c78-3f40-4e54-b3a6-79565f6bbeae", "comment": "Malware payload (Mirai)", "value": "9302684bcd4a7d984bc28f09e8b76d82", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632235746, "uuid": "59942155-dba0-4f5c-a3b3-d3f649e73e0f", "comment": "Malware payload (Mirai)", "value": "faafb8c27a8365f308ee79a187ad25fb38ce5e34ecc716cdf8386e8b8f0c6036", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632235746, "uuid": "9bf56667-db0a-4915-a256-be3af8ff3752", "comment": "Malware payload (Mirai)", "value": "16ec40e688bdff1c1a094e0c5542f353413448e3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632235746, "uuid": "0d41ef6a-99ed-4bed-ba78-0afd7eac4afb", "comment": "Malware payload (Mirai)", "value": "a2f7883aaa0cc4870b84e94fbc99c30d6e25292a949f2000dab57ab39cb20cfce7642ee4abb3ed6169769266d592454e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632235746, "uuid": "0fbad9bd-4dd6-4753-a357-df0b6f780741", "value": "T16AD30842E5B42FFAC101AA7139BB2F240719BC512F1F09966939BBB0037F5DBB04EA54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632235746, "uuid": "de2e0dbc-b4b6-4120-a988-7e93b242b584", "value": "3072:9HHybMwH5eMR/LuXLXVU0B1g8UOim4M1J8zEiuuX:9HHkMgem/LaX2Wg8Urm4M1J8zEiuuX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632235746, "uuid": "3270712b-65f0-4a87-9103-3a0bb6aeedae", "value": 140711, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632235746, "uuid": "aff2201c-8b58-4641-9c6f-9b1f8604ce55", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632235746, "uuid": "e8c3719f-801c-4b95-b6ff-4bba9b54d1aa", "value": "9302684bcd4a7d984bc28f09e8b76d82", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e113f299-1ae6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1632233946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632233946, "uuid": "560f91fb-7993-432a-97c3-a7aaf12b5986", "comment": "Malware payload (ArkeiStealer)", "value": "8e1d0b4bf5f62fda666b9b1b6797bb2a", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632233946, "uuid": "b5bc41e2-d653-401d-a922-0c1fb4bb6482", "comment": "Malware payload (ArkeiStealer)", "value": "fac7d223d096dd7167c78cfb31471434b86f81343b4a2fe86e37c4d9a8079cec", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632233946, "uuid": "861df1b0-0a40-4947-b679-d59527e10b0f", "comment": "Malware payload (ArkeiStealer)", "value": "3dcbca1128e7243cccc9530e0a2a482778aada46", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632233946, "uuid": "9058a070-a756-4dc4-a8b2-249501740b2d", "comment": "Malware payload (ArkeiStealer)", "value": "8f55c903653823c3e703ec28673bb42236fdbb4dad7bddf3bf80641476bede7e1e08327bcb7cf477ed0c8e846edb0403", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632233946, "uuid": "461b0bc6-ec93-4f3a-9990-2522d9f502cb", "value": "T13465E021E292F437D1A3F638DD969B7F9B3CBE103914140B6EE82D685B39380B519367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632233946, "uuid": "e0de93f7-a8a3-46c0-9a59-4b3aa7efb2c7", "value": "c32368f78c61cf2d9d6654d89861a9fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632233946, "uuid": "b04a1523-fff4-4381-ac27-e3bab3903436", "value": "24576:HBuzcdGnDDY8WHA4NKRi9yvbEx2Tw1zRHEH0OhgcoAs03kzGl/rHw9I1u1dA9mvo:H2DCHAl8gDExIE006gcRf3Vl/zw9I1uX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632233946, "uuid": "60487524-387d-4fec-9878-39a45f10e35b", "value": 1534976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632233946, "uuid": "10720c9c-bb3a-4a71-8b78-a9ce66cdc3c3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632233946, "uuid": "1e9995a3-0123-4811-aefc-669010e34597", "value": "8e1d0b4bf5f62fda666b9b1b6797bb2a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd271d79-1abc-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CoinMiner)", "timestamp": 1632215900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632215900, "uuid": "3b2d9d91-15c8-4b09-8810-544bb46c0e78", "comment": "Malware payload (CoinMiner)", "value": "c4ab556b6a1dd537cc1942204fdfd6cd", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632215900, "uuid": "aada19c4-f96e-49fe-86dd-4e0da06969bb", "comment": "Malware payload (CoinMiner)", "value": "fb07a088ddf5bab17add34ddbdd3d4d15ebff15412cadc4c6cea801244801a79", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632215900, "uuid": "d3cd3c59-07b3-4841-8e6d-9db7da31a951", "comment": "Malware payload (CoinMiner)", "value": "91c8f1c171c1710f78a53ab119959e15549c3931", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632215900, "uuid": "5c684131-952a-48ad-870a-019e4afcc035", "comment": "Malware payload (CoinMiner)", "value": "40ce82895695f3695102ce5dc1b07ec4f8bf2edd4d5364c8cec19278af737ff342bd2abcbad8ed6bc0de922fc83c4b94", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632215900, "uuid": "c5d98e9e-f686-4dd3-bea3-b440680f67a4", "value": "T16FC2D11353E9D99AF6134D712EA78798CABECE365C358E6D3ED0900D8D111880E73F28", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632215900, "uuid": "ef3691fb-d12b-4a75-b872-6e7be8a9f29e", "value": "768:deDqa7dYAtp5U5EpoNUzaN0J3TeidJhZv3USedBwi:dedZXfzW0J3aid3xm1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632215900, "uuid": "4a47157b-df55-4666-b810-01da106b233d", "value": 27648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632215900, "uuid": "84bc3acb-641c-4468-b16c-7a96e7174c7e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632215900, "uuid": "f0ea5a60-5bcf-427d-96f2-81c22260cf8a", "value": "c4ab556b6a1dd537cc1942204fdfd6cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e71e3f1d-1b0e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1632251136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632251136, "uuid": "53dd7ae2-b185-4b87-b5be-4725b99d1c5c", "comment": "Malware payload (njrat)", "value": "25d8edcbfc7380216bb0ef29d66e8ff1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632251136, "uuid": "e87c7036-2a85-481e-939b-f08d326ab8a6", "comment": "Malware payload (njrat)", "value": "fc960e98dee6286927405864b8d0f7044eb5241f3e8523fb186e44633ea4e303", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632251136, "uuid": "7b37ddf3-3ab7-4cfb-9bec-476c7ffb6e20", "comment": "Malware payload (njrat)", "value": "b24f4b08cf73da046421ec55b2520b1e89e9400b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632251136, "uuid": "8a6350cf-6d2a-4cb0-a11b-c4b74300a9d1", "comment": "Malware payload (njrat)", "value": "8744f8541e28da28013642224189a8fc08f1ab08b41297fe562603213ef07ea68d86de1bce3b3da01bc88de82a9725e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632251136, "uuid": "8fb955ac-4b60-404f-a0c7-08191fa9bff3", "value": "T1BEE32A117289EB13CD2A79390C52259873B79BC73753DA0B3FCDE6B95543B8B4B18222", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632251136, "uuid": "974453f4-9b74-4c00-8052-25237451d271", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632251136, "uuid": "3eb86c48-f7d1-4b7a-b65c-ac25d2bd787b", "value": "3072:WU1dsbRjH0ScSqHXHl8g6s+yq4fUQKp4xHNf:WU3sljH0ScSqHXlp+yq4fU9p4xN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632251136, "uuid": "34ebf5b9-b216-47c1-9d60-0366ba894487", "value": 153088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632251136, "uuid": "70c4a2ae-b1f9-4769-9202-41258bfcdb50", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632251136, "uuid": "f7d30230-8954-4ef6-92e4-9362f38c677c", "value": "PO #KV18RE001-A5871.pif.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae58ff94-1a94-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632198642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632198642, "uuid": "caa10590-c5d4-4d33-a084-fe55bdd81bdd", "comment": "Malware payload (Formbook)", "value": "a3279da350cf134f736629e5e55c0a41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632198642, "uuid": "1fdfee15-de0b-4c81-9cb5-0bb71a593f25", "comment": "Malware payload (Formbook)", "value": "fc9f8f3e66f8ea09953b7b5eba261ff36eb9a78a5f92787eb879420ee3bad581", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632198642, "uuid": "49207d80-5dd8-41d8-b261-feafbf518848", "comment": "Malware payload (Formbook)", "value": "d28cc3a2cc3e16cf38634cab8db41aacebf4709b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632198642, "uuid": "9915ed29-c705-4904-8b88-a8e153558dbd", "comment": "Malware payload (Formbook)", "value": "65b8cb73751fb8442547dbecb62bca03b6ab4b31e189272ef11587be9050129f39197488da62cac16540ab030ff943bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632198642, "uuid": "2723ee7f-6a14-487b-ac9c-0691d85f7a42", "value": "T11D157C394D2682F787EEC66CD08C1FCEDAA6A4837B919F1AC496D7C2025770FE49845C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632198642, "uuid": "866a964e-b355-4443-bcfd-bf5e57bf385d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632198642, "uuid": "3ba8e1eb-5c50-40b8-9a31-de8de099651f", "value": "6144:wo7CaRmi2yzcRWu8ps3juZraUIRbj100ca6Qhio0flq47lPhkdFciqSbSSV2B1D/:w7V/Quj3juaby0VhidtIFESbMB1DivY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632198642, "uuid": "41211ed1-91d4-4388-a0aa-7e7fc927689d", "value": 892928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632198642, "uuid": "fa3121c7-35fa-4f6e-8182-f87ab2827bb1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632198642, "uuid": "756828f4-3058-4505-a663-4e45c18edfed", "value": "UPDATED e-STATEMENT..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4644bf13-1b01-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632245282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632245282, "uuid": "2789db77-af77-4efd-aebc-175913169960", "comment": "Malware payload", "value": "582a0c16e11bfa3c26b223de37215444", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632245282, "uuid": "65c8ad65-bccd-4115-be06-067bcd96abb0", "comment": "Malware payload", "value": "fd2af8376826c31e84f622b26b21a95e583c93b56e20b91ab483dca255465fcd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632245282, "uuid": "39c13647-d94f-40f2-95b9-0dcf2914c175", "comment": "Malware payload", "value": "96c35d092427de3c6642a3b36195196985d10a8f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632245282, "uuid": "291c86c8-30da-4956-99bf-a10ad6a828ae", "comment": "Malware payload", "value": "1327d424ccc8bf11df62dac55d7e08f2652b5d9d4d112d2d479c13817a2309e8f22b420930ee37dd3446b8cf93a3ba7f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632245282, "uuid": "ae32920d-9bfa-4984-b422-3b86a31a369b", "value": "T1F3055AAC9F5ED403FBF00E728C66C868D67B7C6A141EE44F2A49729BA5B1BC774140C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632245282, "uuid": "85d39a42-cfd0-497f-9b52-d1b651941fdc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632245282, "uuid": "afc621f8-496c-40a8-847d-a1b99b099ebb", "value": "6144:ery4k8vOa3NVYiykZzXT/vRerl7wT7uCxhbUkxChx4plQ9PWT:cpkQAiykZzb5mwPuCxhgkxChx4p+9WT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632245282, "uuid": "ce1e6f85-fd74-418d-a352-67016ded4102", "value": 858608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632245282, "uuid": "f4d312f8-77ba-403a-812b-94159e212677", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632245282, "uuid": "7ba9935a-66fc-4b9b-ad9a-14dd71b17273", "value": "582a0c16e11bfa3c26b223de37215444", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f459d63f-1b10-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632252017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632252017, "uuid": "3eb450b4-aaf6-451b-9947-2f6de5e8a683", "comment": "Malware payload (AgentTesla)", "value": "db5282d995bb9e392aa249c265806c99", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632252017, "uuid": "c09f8b37-fced-49d2-8eea-7a9cb5677f8c", "comment": "Malware payload (AgentTesla)", "value": "fd76859c5d563d177532d34faf59d434061ae15162219cff789df2ef1ebe12d2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632252017, "uuid": "4138c284-f135-4a99-85be-c2b0b067f73b", "comment": "Malware payload (AgentTesla)", "value": "ad9e2d603ead7fd9e2f8d60d03b098013ac3ad94", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632252017, "uuid": "e4e88329-1a28-41cd-82c8-d2c8c836ce5f", "comment": "Malware payload (AgentTesla)", "value": "e77cdbdfcde3e1e80556414e9e4dfad7eae4fe4d06aa5cc76f251ddb3705ef4d51400100d3fb80060b612ded7e9fdb5d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632252017, "uuid": "40d49599-0e0b-4194-a29a-b37cc84195b6", "value": "T153B42338D56C8A70DD7ACFBE24B0104A0774520E3E17FAA45EC7F089DE9E76212658F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632252017, "uuid": "9b311e67-daad-43ef-9353-92b5e16d3a94", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632252017, "uuid": "9cafed30-fcdc-4db5-ac52-cf619ef98914", "value": "12288:Pt4qmtiK5oBLvuYc7tqRSEUY9FKx0gNIVUaGBxBj:X+FoBbuYc7tA9FK2gZa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632252017, "uuid": "5a0b13e4-4ade-40b8-a4cc-4092c7f2dc0e", "value": 525824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632252017, "uuid": "841fe346-2c5c-4f37-95fb-51419161e999", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632252017, "uuid": "2a68afed-d204-471c-b838-848760de3fd0", "value": "DHL-7002021092111.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac576ea3-1ae9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Quakbot)", "timestamp": 1632235146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632235146, "uuid": "f27ce7ba-6d67-4102-a464-1b081b3ffa4f", "comment": "Malware payload (Quakbot)", "value": "d5d1a547402dabb68d73e0669c269792", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632235146, "uuid": "139c9b88-04e6-4ceb-a427-7d3982f44e70", "comment": "Malware payload (Quakbot)", "value": "fdf9fbffc3dc98257534ef6a5a7eb9b448d9e539ebb7e662f62ee06c40a55e51", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632235146, "uuid": "1968f425-f6ac-4bb1-9912-2de73fe54121", "comment": "Malware payload (Quakbot)", "value": "b61e79ed19d2f7480f63868315ae6fc5b0252b0a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632235146, "uuid": "13e5707e-b585-4717-90fc-3f01d1eabc3e", "comment": "Malware payload (Quakbot)", "value": "44dc989d9bd149760e108de3ff83f420829d989c1047299a38e8c586c0c59f9f643938ad9d53a7171cf659c1cfe48dcd", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632235146, "uuid": "8cffa83e-2537-4867-9253-0cbe7a0e8d15", "value": "T1B8149257A9058AC3E51C93F8BE434ED92F066F08E9563EEB21153F8A7F742530D8A11E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632235146, "uuid": "a92b7ab5-3491-4a10-868b-94e0a224acb9", "value": "6144:AKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgOSrofSHq8oD5S:Y1F55S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632235146, "uuid": "e0519114-88a7-4d86-a419-7d6429b859d2", "value": 203776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632235146, "uuid": "7f25a645-a4d2-4bfd-ae2d-f07da33d5bf9", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632235146, "uuid": "dcbd582a-184c-488d-82a8-55d20f46a607", "value": "Payment-1313665497-09212021.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f08a4c30-1ab5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632212926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212926, "uuid": "7bc0f452-f321-419f-b419-bf3a71d930ca", "comment": "Malware payload (Dridex)", "value": "f632073c7ba842028460a74ef1551ba0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212926, "uuid": "786ce95a-23b9-45c0-9f01-b681b8712fb9", "comment": "Malware payload (Dridex)", "value": "fe535a6174de81da4134dd3378e71af2fd99101a62bc2ad01ea2515b26a3ef01", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212926, "uuid": "f85ef82e-27fd-4d8a-ba5e-0974a875a561", "comment": "Malware payload (Dridex)", "value": "dfef2c0652882cc934935cff4ce83ebedb6eea98", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632212926, "uuid": "252daa45-21e2-4ac5-95e1-512b69a0b26b", "comment": "Malware payload (Dridex)", "value": "2bff755e4835b4f94ff4fdf852bf033800cadf78d0dbc818fc167faaa082050e39451fb9759bdf4e59791dbff01f7147", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212926, "uuid": "46ed3f46-0e31-43d7-a51a-29a4ff080db7", "value": "T1E0C5D010EF69E1E6C6B89F3E9408352727F93D75110D608CC392608F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212926, "uuid": "189492ad-7fb8-484a-9bd5-b118b8cc223c", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212926, "uuid": "d4b7f009-7618-4b69-9a4c-e26101ead4f0", "value": "12288:xVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ151:AfP7fWsK5z9A+WGAW+V5SB6Ct4bnb51", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632212926, "uuid": "b7fb976e-8a6b-4c31-9b64-35e80923a3b3", "value": 2498560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632212926, "uuid": "b2c09247-ae5a-4f2d-9b31-e9fbbc32f04f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632212926, "uuid": "fa71e656-4d5f-4ce8-9c14-8e95869887ed", "value": "fe535a6174de81da4134dd3378e71af2fd99101a62bc2ad01ea2515b26a3ef01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8acbb42b-1ab6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1632213185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213185, "uuid": "37c246ac-4cbb-4bf1-ad5b-967d38edf37d", "comment": "Malware payload (Dridex)", "value": "a7bf47415d51487c779274232e80ca5a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213185, "uuid": "2f88ef79-db14-4d95-8b5c-3cd2885b4645", "comment": "Malware payload (Dridex)", "value": "fe5c928ffd6c1f298f97290cc0811c53376eb3b97fcf23e2789b8a20fb496438", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213185, "uuid": "4f86a9cb-e7dd-4f42-85d3-b68ac77e25fe", "comment": "Malware payload (Dridex)", "value": "b1bb246a3af51fa3dc9797c43953c4bc1684497d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632213185, "uuid": "594406f2-96be-42cb-a716-0e10ed772131", "comment": "Malware payload (Dridex)", "value": "61e9d85fd3927251ac9790c4c544e5778e6da0e95037ba1ffd7a1053335b3e0c616db7bd9aa43bd3292a44645ecd68b4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213185, "uuid": "dde2ee56-4de8-46a4-a60a-6c4d0bd2d39b", "value": "T13975D020EF69E1E6C6B89F3E9408352727F93D75110D608CC392604F5EF86546E3E9AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213185, "uuid": "4d3ea066-c2ff-4009-b39a-65ebbb3a340e", "value": "6668be91e2c948b183827f040944057f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213185, "uuid": "70835bb3-6f09-455a-b17e-584dc95af9d0", "value": "12288:FVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:cfP7fWsK5z9A+WGAW+V5SB6Ct4bnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632213185, "uuid": "86a6d767-6f4b-41cd-9dc1-7c18971ba1ba", "value": 1638400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632213185, "uuid": "986d2f1f-8e86-4934-ab40-27b724c74259", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632213185, "uuid": "8142be48-95a2-4a03-b64e-d25b59001326", "value": "fe5c928ffd6c1f298f97290cc0811c53376eb3b97fcf23e2789b8a20fb496438", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3965dfd8-1ab9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632214337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632214337, "uuid": "99964bd1-5726-405c-a8fb-63041037e997", "comment": "Malware payload (AgentTesla)", "value": "6d4bd40d14ddce0edd68155fc9357caf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632214337, "uuid": "c09b6d95-f228-4aba-8c8d-4c2ef5699031", "comment": "Malware payload (AgentTesla)", "value": "ff8feaa003c8f622d0888744ff9896bf2b7c9f5da33ec6448abbbea4d697a609", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632214337, "uuid": "0c17a99e-92d9-4f90-99dd-927b735781e3", "comment": "Malware payload (AgentTesla)", "value": "b17312687841da5f71e7493ff46eef0cff561c54", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632214337, "uuid": "9fb7c41d-dbe6-43b6-a1e4-edb799240714", "comment": "Malware payload (AgentTesla)", "value": "f9d2cfd45859703ca136c5b50688b52a2aee1c2afbe3748a9249a33f55af31f0637c45ab4cdce3002abf36e3c96a9ec9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632214337, "uuid": "ad4819cb-4143-4a4f-9764-a8adc3131d48", "value": "T1CE158D394D2682F787EEC66CD08C1FCEDAA6A4837B919F1ED496D7C2025770BE48845C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632214337, "uuid": "d2c668a3-e180-4809-9ede-e2ff337cb647", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632214337, "uuid": "77f724ea-7f25-47dc-afd9-264061c9a843", "value": "12288:gd/i/ihkMaYZi5W4HTVeJlvUCEHKpJ6sQkXNm:si/im64R22HmxXN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632214337, "uuid": "e1b8526d-4062-48b5-9570-ce400bcd5bc1", "value": 909312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632214337, "uuid": "66720d16-40be-46c4-9e29-d4a5c07ab647", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632214337, "uuid": "bebc0167-cd47-4ba9-aed8-7b7787694c6a", "value": "New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }