{ "Event": { "published": true, "date": "2023-07-19", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-07-19", "timestamp": 1689811382, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "9cf94584-f650-4a39-924e-a1465115f66b", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e520d9d-2628-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689766585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689766585, "uuid": "67a19d0b-1e08-497e-a0e5-552b97eb2dbc", "comment": "Malware payload", "value": "109bbbc448d6f309909170cd22fbbb6e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689766585, "uuid": "27a60e95-51a3-4f93-a2b3-0cdefb32c7e4", "comment": "Malware payload", "value": "00c88d648d3ee12a807566edc7636b2dda3c1bebe1bfd6ebb382c92fe1e02b75", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689766585, "uuid": "3c136539-8ff5-49fe-bc4b-b17bdf4b40ee", "comment": "Malware payload", "value": "afbfc909e73182950f0690cf003f89bbac7cd89a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689766585, "uuid": "af1b7597-c374-4b9a-b7aa-c5795e87f831", "comment": "Malware payload", "value": "c73546ff932564224626d2ab1a95d3707b2ff094856f57f6433fdbe083df5b521d5be361f32efe419155ec81d63e3f03", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689766585, "uuid": "8d21ec13-b34a-49c6-8706-75d335c1f7af", "value": "T1F35512F243E88245F2BA63BA1A2CD2585F7CBC0255A0D20A45D648DDD9F47C2EC9973F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689766585, "uuid": "a827e5cf-a757-44c4-8ca1-65af668a347d", "value": "a8fdcb312fa4f4c1da07ac70e3a2f0dd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689766585, "uuid": "c58d2a03-7350-41b3-917c-93ed46109758", "value": "24576:lgpSttGlLfpm/myRvpDRs0EY/J7NJtP7lK+/aeksIr9:I5LyR177pKYaevy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689766585, "uuid": "a7e4223e-727d-49b7-b9f6-c4f5255cab11", "value": 1359872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689766585, "uuid": "1258688a-bf39-4632-b275-945b68cd6bf3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689766585, "uuid": "e347e855-ffe2-40d6-aa4c-641a5fc67c59", "value": "LjtdWS~o.cpl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ab62a16-2666-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689793261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689793261, "uuid": "d4242348-d6d7-4bc1-9c21-ee9b1d45464e", "comment": "Malware payload (RedLineStealer)", "value": "fc7e32e9f36e18f5374981078f20de8c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689793261, "uuid": "4a2b27dd-c1bb-4726-b32e-7a09fafe5266", "comment": "Malware payload (RedLineStealer)", "value": "025d9ce9672a8815520fad4e9e12f2869eb8dd3a2283c7c6e407f6eb4658a79e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689793261, "uuid": "23b8b381-d65f-401b-9eec-4bf556b5be94", "comment": "Malware payload (RedLineStealer)", "value": "9961b14d980ec05fa53f24e4b24f4f0b194f7a98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689793261, "uuid": "1f4073ca-9357-4072-9bac-be894b88caf5", "comment": "Malware payload (RedLineStealer)", "value": "a6210365d7aacda2b22f80b177c84d7c96ea11055ec7a9bdc5e69750f19df393518dd7c2dae0ccb9a34d17a28e7a7bbc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689793261, "uuid": "d4c5fe0f-dac6-45b3-b954-81403b5be65e", "value": "T1B0B41243BEE84573D9B613706CFA03830B3A3C6199358BAF238999D91CF26D46935727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689793261, "uuid": "5046ae09-8ed0-41f8-b3bd-71882350b5fa", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689793261, "uuid": "15abe967-d5b1-48d8-8f9b-9fe49bbc668b", "value": "12288:lMrXy90R0+CmQEaHFD9ZBCZO0MrjVtF2X9Ml4mW4h3:ayAmmQ/HFROM5PVt8XWl4ed", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689793261, "uuid": "52fd9196-9f5e-4946-b777-ff2893f199a2", "value": 527360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689793261, "uuid": "5a0f7a0a-0ab9-4e18-96c6-9de53e12a0d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689793261, "uuid": "7407fc15-4232-41be-951a-7f2423e80aec", "value": "fc7e32e9f36e18f5374981078f20de8c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b34771a8-25e4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689737468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689737468, "uuid": "4b0167d4-c498-4182-b80e-210ba3019964", "comment": "Malware payload", "value": "3403ae44d6dcd0a0100e0756fb56820c", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689737468, "uuid": "a95ff74b-87fe-4c3c-bdfb-e23bfb46a64b", "comment": "Malware payload", "value": "0280449bd8f450d32b87d690765b8693632adbb6e56a29e4cec96b03c87fa2ee", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689737468, "uuid": "10e2c78c-ce2e-42dc-a304-fa92567a73bf", "comment": "Malware payload", "value": "a4d42a25d26a172c49f342ae1f976b050495dd7d", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689737468, "uuid": "9ab930d6-13f2-4fef-975e-930b89010eea", "comment": "Malware payload", "value": "353d461ed38b6ea125ff97357d3450b7dc0c1446ca79f567ae1226e4811684c1187a20b1d72fcec7d51e8e93cddf9659", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689737468, "uuid": "10db19d1-a53f-4eae-8616-5a8226ceef85", "value": "T1D816F143F358992FD5B7C13606B70736A1964C069B4393573A28B26C2EBBAD05F85BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689737468, "uuid": "9f14436b-198b-4308-9457-6d1687a3b4b9", "value": "98304:tSwO267dexqnqxjFtOvSXPZhgjTQ9OGqo2iePdlgAqM:C26cxuAC6XBhgvW1o3T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689737468, "uuid": "9945d673-5695-48b7-98ac-84e5f7515b43", "value": 4209862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689737468, "uuid": "0bbfd6f6-c61f-4d1d-b21e-82303fb22d4c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689737468, "uuid": "2d01b1ba-af4c-4417-8ff5-0eaa442d208a", "value": ".apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f47114d-266b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689795363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689795363, "uuid": "dfa27af4-9f57-4c7e-8691-4857c463d438", "comment": "Malware payload (RedLineStealer)", "value": "045abca1540fa094aea747b85563bf74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689795363, "uuid": "9140bbf1-c9ab-484d-8725-de9375369b26", "comment": "Malware payload (RedLineStealer)", "value": "0284f96644d60bf327810b35dc69c753d503fff4df824047928d07e6926499d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689795363, "uuid": "da3819db-d800-41b4-9bd8-b307f89faa56", "comment": "Malware payload (RedLineStealer)", "value": "acef39ddd4e411add5fcc5e15d8310819fa02abb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689795363, "uuid": "5bb236f7-eaa9-4d6b-87a9-a6d7eae1ab40", "comment": "Malware payload (RedLineStealer)", "value": "ba56f10788ecb7ad84fd3522c9d2f7efb060f4f084ec7671c41b94323a1cb1ce3bf668ee5577d8f48a14d491b3581438", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689795363, "uuid": "51d29278-cc30-45f4-afb7-9fc890bd9ae4", "value": "T1D4E2F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689795363, "uuid": "51e76e66-09a6-4559-a3c6-de011cffbf5c", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689795363, "uuid": "7d8e64fa-890e-4b79-a4e0-073c89be845a", "value": 31144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689795363, "uuid": "63903650-c016-40fa-8c00-711e9cc76fdf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689795363, "uuid": "2c9375cd-9792-4feb-a80b-bece289eb1a5", "value": "045abca1540fa094aea747b85563bf74.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a39c8064-2620-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689763212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689763212, "uuid": "729415a3-ab01-47d9-ab25-ba5958f6c852", "comment": "Malware payload (AgentTesla)", "value": "93df36476069ba35847c30ad26d05880", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689763212, "uuid": "3fee576c-b978-4030-97c8-9ab28972d43e", "comment": "Malware payload (AgentTesla)", "value": "0422c9546bd72399494b2f89026d1bccb6ce039e76d4df745d11e8d29d298b77", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689763212, "uuid": "4989aaf7-9693-4e2a-9dc7-1d8a0bf3bcfe", "comment": "Malware payload (AgentTesla)", "value": "2d4b1ec873a68e489128bfe0b345e26d3601bc85", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689763212, "uuid": "91a6f981-0ed8-4163-b075-db59532ebe05", "comment": "Malware payload (AgentTesla)", "value": "53204efbb6a65419dce336c673d613b4d1b9697059cc1d2f90dbe50af90844174c876bc51e792aef1ceca38f40603333", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689763212, "uuid": "44c5b1ae-956b-4726-9abf-171a93509464", "value": "T1B5D423694DBA641BD73F2FBB100071F142991BD67115CAA25D5EF0BBEB2AB8E4C01B07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689763212, "uuid": "e6dddcaa-8938-4b99-83f3-d8268e1f74a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689763212, "uuid": "194c6fd8-8082-42ac-8f76-43d6c9089ec7", "value": "12288:WmAY2kcdbL4Efqb7lsHgUtOrRu+Tjp4MT1ociOl1Rx4zxOn/olpbKOa:fN6GEfqKHgUt4vjp4ali2uQKpbb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689763212, "uuid": "d855098b-ea95-4999-a8ef-758925e49f75", "value": 627200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689763212, "uuid": "63bff24f-f2d0-41db-94b0-abd3612d22b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689763212, "uuid": "2b9f8313-58c4-4e6f-9b1c-3f24288f71f5", "value": "Oferta OFER30052023 NTV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6d11991-2607-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689752533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689752533, "uuid": "0a138efe-ed5c-4489-8171-f431e8837bfd", "comment": "Malware payload", "value": "5eabbfffa685242edc8a9ab635c2be23", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689752533, "uuid": "f4c814d8-dbf6-451e-870d-1097a8bfec49", "comment": "Malware payload", "value": "04d499a268bf6d140afe2461621df5451f1b7b569bbf5eadb19cb334fcca0d65", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689752533, "uuid": "117a610c-46b0-4971-af06-a9a5e088dde1", "comment": "Malware payload", "value": "6eebface70e03c577201120b98022f6a80701583", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689752533, "uuid": "91787921-45c3-432f-b0b6-14980c5382eb", "comment": "Malware payload", "value": "4c1e56a6b340087cf59cf36a2b1eca995ea6212ee1de47a4071c5c3432eee241ecc74867ed9edfc6dccd493d92ebce0e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689752533, "uuid": "2f5b3085-d0b8-4675-bbdd-0a78065de9a6", "value": "T1FFB1D71B829D9772F1B4D8732BEB555F188DB47003AFA08B27991176209C1D2AA70F53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689752533, "uuid": "0c521e7f-6afb-4bfa-93fe-44b7f32a12d5", "value": "acd1d84bd0e367458dab18494623671b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689752533, "uuid": "698f3221-844d-41a7-93d0-f8f61ff7fe4d", "value": "96:XprYDpKnI6wJ+Ls7guyHejyn/I9l0iai1bZe:XUcA+ggd+W/If0iM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689752533, "uuid": "93da72cd-8632-4e67-abe6-766a914fe178", "value": 5120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689752533, "uuid": "296ff411-4651-4d90-8b59-55520ce9bdd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689752533, "uuid": "e74c8210-d0e3-4052-9e34-c0134c44dcc0", "value": "4z.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee7977e5-2665-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689792972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689792972, "uuid": "90638878-13d4-4a5a-8754-7f1e8ddf19bf", "comment": "Malware payload (RedLineStealer)", "value": "e5c4993979c3f12da1533fc9b05a2d11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689792972, "uuid": "9dc45556-9c5d-4bf9-b829-0a1e99317b54", "comment": "Malware payload (RedLineStealer)", "value": "0727d0cb1fc26f9ac998ed80e886d70cb462d604cdd544abafaa80de3982ae4c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689792972, "uuid": "82e55a9f-e393-4325-8cdf-6159dedbb920", "comment": "Malware payload (RedLineStealer)", "value": "fa7614f60611951b54be4fca08a9ff05a40bde9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689792972, "uuid": "4a9ec9a4-80aa-48c4-8324-552f033eb2e8", "comment": "Malware payload (RedLineStealer)", "value": "b33177e89cc44c5659448b4a51899bd2c6b4cd2631ffa55a77d76824cc4628ad1ad7ac31fd42cd9548be3f0255489dac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689792972, "uuid": "fca5de9c-0968-45d5-8378-f5d389c89742", "value": "T177840113E7E85132C9F927B028F603C30B36BCA19E74936B3B55659E1CB3291A835767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689792972, "uuid": "27b8db22-582d-425b-98de-f332fa02aac9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689792972, "uuid": "cf1d415e-178b-4a7c-9a1a-bb5fa5490310", "value": "6144:KKy+bnr+4p0yN90QEu6p1WtClK+P5Oc5ueqD2320HtEA88IxQ8xa7f:yMrUy90s6p1WtClh5u7ffVQca7f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689792972, "uuid": "03b9f218-0d93-4012-9de5-ce64d88c2e34", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689792972, "uuid": "52e6cfbd-393d-4502-b061-a6a75d0a6751", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689792972, "uuid": "32615aba-0a2c-4ab6-aa20-68445e8bf2d8", "value": "0727d0cb1fc26f9ac998ed80e886d70cb462d604cdd54.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfdcf1ce-25e5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GCleaner)", "timestamp": 1689737946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689737946, "uuid": "97dca2ab-831b-4e81-ad74-fdcac5f87d30", "comment": "Malware payload (GCleaner)", "value": "582792f1a99944c1d744fda791465d20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689737946, "uuid": "db640538-63cd-45b8-bdf8-6b0c926549ab", "comment": "Malware payload (GCleaner)", "value": "074773bac4924b4d1637b4005b9da53d721a4341ee957f63c16bc4723914e586", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689737946, "uuid": "26d8f591-9d9a-45c5-a5fa-9d69652580c5", "comment": "Malware payload (GCleaner)", "value": "55b637ff9e1bea011239f28ebfc714343336f700", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689737946, "uuid": "d7ae1e88-57ae-4f2a-a1be-7d9b201e4c66", "comment": "Malware payload (GCleaner)", "value": "2d7fc8ab65a82398374c0c4769bfa12a09d83baf22331cf565019390086d7ab00bc77748be79f4c6368874839c0d038a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689737946, "uuid": "8bc44a6f-d48e-4fec-bcfd-f733a0839eee", "value": "T1918533436692A0B4F6234EB9BD746887C3637974A4629A5532CEFB4C5F3BEC35402B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689737946, "uuid": "743e1436-adc0-43be-8cf2-515a5ed88c74", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689737946, "uuid": "bebb0899-678d-4c06-8a41-87c7fb0e03fd", "value": "24576:k2lWLzyaEhoYCltKvqE895pBCv76iZ8mZQgYxsbtezfOt0XixubvEM6:k2YLzyX4lgvqauC9QbxsbtyfCCpB6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689737946, "uuid": "a42f7c4d-ca44-44be-aaf2-1ae1f7d762c0", "value": 1745885, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689737946, "uuid": "af1b433c-a61a-45b5-b35d-4342f07c318e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689737946, "uuid": "e6344278-3fbf-4939-b660-b0de496ba923", "value": "K3M3VqmGTQMAPYQR7xSmMJkK.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09af2a5f-2685-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689806333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689806333, "uuid": "2a52bf29-ac5d-49c7-bd5f-53ae75a7e275", "comment": "Malware payload", "value": "ac6085dd16738c1fb79968344ac8582c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689806333, "uuid": "6d82b478-ab75-4cde-a81e-5594a28832b2", "comment": "Malware payload", "value": "0824b117cd7e5ca894368feea852ffe7aefb584974ab8bf7ad87a53422e5effc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689806333, "uuid": "92044a9f-634e-4e38-a3b4-c84a5d6ae8d2", "comment": "Malware payload", "value": "7c25dbe45ddc442319bbd175c7ec98761c8bc226", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689806333, "uuid": "40f44a81-b643-43e9-a6e6-83d3ff3f4167", "comment": "Malware payload", "value": "6f1039002ddb1f02199b3e1dedc9529313907ab7146933537d76903abdd4f249477bc03d42b1568a421496616a86da10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689806333, "uuid": "29e21e02-f5e1-4504-9b44-80edc990eca2", "value": "T1CF853372D59189F4F5A21EF0ED10E92931B67C24DD78CD4C3AAD6A9D2F379420C873A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689806333, "uuid": "a76a8f8e-db95-46bc-a93c-1a8bd7acaea8", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689806333, "uuid": "718427f0-f59c-4f9a-b2cb-8d6958b64f90", "value": "24576:P2lWLzyFufrY/KvGaBnhDXgw/n5lpNowMFM0MGmxkDUNCCkMIubvEM6:P2YLzyFv/KOQlQw/5lTglMGmeY0XMtB6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689806333, "uuid": "bc8c8162-9187-43d4-b101-be35fb46d5e8", "value": 1749167, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689806333, "uuid": "944eb073-8800-4284-8d11-f80b7b11a18c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689806333, "uuid": "a688243a-a40d-4eba-a2f2-ab7af66599e9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a361167-25fd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689748029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748029, "uuid": "d584946a-983a-44d5-ac1f-93b877f44784", "comment": "Malware payload (AgentTesla)", "value": "140f684cef3e0e41fa3da246de30b833", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748029, "uuid": "474e8b5a-f0e6-4b24-969b-c229bad6c326", "comment": "Malware payload (AgentTesla)", "value": "085692e71ab34556d9c9ca011c81b75997225a5c2a9b6047d8d701e77ec23e06", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748029, "uuid": "97bcce64-32ab-4fd0-83cd-d69ed47a5b7e", "comment": "Malware payload (AgentTesla)", "value": "1d3047159aa3f22583bef39841162cbd4cfb0a09", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748029, "uuid": "410cae8a-82c1-4985-abcb-452db6906fa8", "comment": "Malware payload (AgentTesla)", "value": "e5acb175ba5bf786c65fd3150a5d45eab5e9846245b285d0a8fa958c7079ddab70139bed89c18d6c9818c63fe160d065", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748029, "uuid": "8d197199-2e79-4db5-bba7-116d39deb469", "value": "T1B8D41294EAB9861BC4B917FC1770430093B86E467822EA1A8FCBFCD9747BB416650F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748029, "uuid": "6fae2aef-b3d7-4370-a71b-398653c97d2b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748029, "uuid": "9e27a56a-4d3a-49cd-9bc9-d3e0a1e460e4", "value": "12288:iPYPfY7glxyr//yUW5U9JUXWLcppYmceFKPldwc3hbg/:iPYPgElEr/PWs6UP93hb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689748029, "uuid": "8870cb54-f597-415f-9cf3-aa88e9a8ad4f", "value": 649216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689748029, "uuid": "128b525c-9f7f-4e17-9067-7f8c9f2d8e34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748029, "uuid": "eff03354-bab4-48b0-82b8-452c32a27f83", "value": "DHL Shipment Doument 19-07-23_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c0056e9-25e5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Glupteba)", "timestamp": 1689737724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689737724, "uuid": "9e6b3af5-fb93-4a05-8b4e-8a38b36079f5", "comment": "Malware payload (Glupteba)", "value": "b2bb40e3a05ab89ab8fcc9b29bca5479", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689737724, "uuid": "b34295fc-aca0-4357-91db-b7f42361679b", "comment": "Malware payload (Glupteba)", "value": "093d7a53e333c1c703c43b36e99554a958b34fc160f818357fcdd31a376eece4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689737724, "uuid": "ed4a3782-07ca-40e1-b34e-430e1630f05c", "comment": "Malware payload (Glupteba)", "value": "20ff6164cebd19f037c9299d1f53f3a85f862387", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689737724, "uuid": "70261806-f623-4e5f-a5d8-218a355c8133", "comment": "Malware payload (Glupteba)", "value": "68ad0114a5c3edfb40d93a63bcc46c30353f3e9dcea581a009a837a241dbd83087241928e7ecf09053aecd1e6e125092", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689737724, "uuid": "5ad6d011-f12d-47a2-9de9-3a8983545782", "value": "T17E16235392803C85D95E4B7A8E0FD3AC670DF6504D8A3769A12DAE2F00B22F6D1B375D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689737724, "uuid": "69c3d3c9-4f68-4e0a-a801-588ad3a3e625", "value": "41b4eb7c12331a5ff00a984ecb434d03", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689737724, "uuid": "72474105-a28e-473b-8781-d272071234a7", "value": "98304:R9w9tgfoamz4e+q4u1fP4Kc7ECViy9QRTKHkkmKZtbCRw9EC/B:gshSyLxUT0kkLtbCRw9ES", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689737724, "uuid": "4a1af765-ed92-4714-a52f-72c6eae11ee0", "value": 4393352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689737724, "uuid": "b23d1a48-1694-4d7c-a9e8-a51cc6a5b2bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689737724, "uuid": "d9008624-ca70-4b4e-9c72-2cfc817dd80a", "value": "csrss.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "697c9f97-2601-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1689749800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689749800, "uuid": "364b9723-2c5f-4b77-984d-c2136fef28d7", "comment": "Malware payload (Formbook)", "value": "948b8c028268c704b439071a9fe65538", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689749800, "uuid": "8073bd81-806e-4ce5-8fe6-a24c22ff7cf4", "comment": "Malware payload (Formbook)", "value": "09a46413e5df831a43d988315fc1973f8ec5124fa4d984c84da40d8a2b15f1ba", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689749800, "uuid": "9b0f0097-2257-4756-aa24-e0ca3bd52eef", "comment": "Malware payload (Formbook)", "value": "cc272f6d7e1a7f8c95f32d7c94297d8168141678", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689749800, "uuid": "24d60993-b8ca-4821-a3ba-08c0fa6249e9", "comment": "Malware payload (Formbook)", "value": "4b8f78c0e92ef1551c29d4114e011b255ef4618979fbb0cf6edc49467ccafee562c4bd8bc485d568d149d16fbe032e33", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689749800, "uuid": "f26e9dd9-1461-4c2a-8233-a2d93d42781a", "value": "T120D42200A7A0C633C2E427B42720E365636D8FCAB455DA1DAFC6ECCEBC6F3545295A17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689749800, "uuid": "fb4a4857-ef9c-4535-8546-9bbc5505126f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689749800, "uuid": "8b823b83-3598-4c29-9822-dc88b25eb953", "value": "12288:EPYPfY7gD0WaWJ8cpz+gAsQoVcjVR8O3IG0wTlZL/Ov:EPYPgUBJ8yzT85xR8/GnT7O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689749800, "uuid": "cbd6c1ea-a519-45ba-aea5-0eb6c993e79e", "value": 654848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689749800, "uuid": "9200b44c-bf86-4c4c-a41a-fbb2e02cd590", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689749800, "uuid": "005fc43a-b046-4185-a35a-710dfc936508", "value": "948b8c028268c704b439071a9fe65538", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea027b73-25e0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689735842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689735842, "uuid": "a351a612-2ed3-4e6e-b49b-a869e986a8d9", "comment": "Malware payload (Amadey)", "value": "2e36fd87f02328791390c79351931433", "object_relation": "md5", "Tag": [ { "name": "600MB", "colour": "#73751E", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "pw-1234", "colour": "#ADC330", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689735842, "uuid": "36baa3ac-c08d-4d76-a5b7-26d7efbc6b9f", "comment": "Malware payload (Amadey)", "value": "0b08896a3e4f075f31137c62ada7c448deff3a2b0d294b8f751780fb9cf5ee9e", "object_relation": "sha256", "Tag": [ { "name": "600MB", "colour": "#73751E", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "pw-1234", "colour": "#ADC330", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689735842, "uuid": "5a4257c8-36c4-4e81-bc2e-dcd5c1f8bbdc", "comment": "Malware payload (Amadey)", "value": "0333df1d93321d6e8e6eb57398195deebb7fc464", "object_relation": "sha1", "Tag": [ { "name": "600MB", "colour": "#73751E", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "pw-1234", "colour": "#ADC330", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689735842, "uuid": "56789a22-2234-4e26-bc71-3a73aa649bbc", "comment": "Malware payload (Amadey)", "value": "ea09560000703758faa414f6e509825ea31bf3f627259dab6da3996219d7d26f2223b1ed08d4262e613474fab7f9918c", "object_relation": "sha3-384", "Tag": [ { "name": "600MB", "colour": "#73751E", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "pw-1234", "colour": "#ADC330", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689735842, "uuid": "280f84e8-c989-4441-aae2-89855fe16ecb", "value": "T176463373DC9F3A415D9A28033F454D8F222D1795FA5B0C293BCE4EB057AECB9E691260", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689735842, "uuid": "f5338aad-7d03-42c6-985b-3d07805d4dbf", "value": "98304:qnajiIUlsOnb8jOx7ITyfkVJrMGzouLbNGX5PeR8LL9t+YIBatXUM4neOMuZTiU2:qqiIhOb86JnfYrjlLbNO5WyLrhIBaZUU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689735842, "uuid": "3f1679d7-0d53-46c0-a46b-f9ca40f1ead2", "value": 5510355, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689735842, "uuid": "b7422e17-a067-4539-86d5-4c223e72e221", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689735842, "uuid": "6510e2c4-624a-4494-8d5f-188734383ba4", "value": "File_pass1234.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e44d3078-266c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689795962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689795962, "uuid": "96a00a78-d65e-4356-a745-74a2e968916e", "comment": "Malware payload (RedLineStealer)", "value": "d2054ccbdd8c88942345e6b8eac95b91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689795962, "uuid": "bace6193-0ca0-4177-9181-f9f580aa6e5b", "comment": "Malware payload (RedLineStealer)", "value": "0b1d10bad8f355445f5a1db1cbee3cead10d8158a08c09692b8c1d81bbf5f706", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689795962, "uuid": "30c8603f-f57f-441d-ab84-8a2cc9bffab4", "comment": "Malware payload (RedLineStealer)", "value": "880bcea3ab1cf6f385f3bd592ee3ca8af9528e1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689795962, "uuid": "d50a41d5-7bf8-4e49-bc00-ebee5fb885c3", "comment": "Malware payload (RedLineStealer)", "value": "0cd5d8cf12921b91c1fc634600fd944781173e5d77b6720f9e46a5879a477b1643128b3a4d14874000a04b0ddba03e76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689795962, "uuid": "0c847fab-ccd8-41d0-a5fa-c565504cdf60", "value": "T13A840212A6EC8133C9B51B7069FA03832B36BDA19A38436F3751595E1DF39C4953273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689795962, "uuid": "6c5e916a-ed7a-4356-9b62-2d90b2ea8a69", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689795962, "uuid": "3260c862-8c05-41a2-852a-c3b8b830b58e", "value": "6144:K7y+bnr+1p0yN90QEkiFClK+PFOcfoIAgSnNeQiFscZJC2K//qf4:hMrxy90TClZAHNeQiFs82H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689795962, "uuid": "eab4d1ee-f99d-4672-9486-7c6e8f169375", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689795962, "uuid": "d564b6a8-804e-47aa-a35b-11e8c53dade5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689795962, "uuid": "8529601d-3ed3-43c4-8ccb-a12339982d7d", "value": "0b1d10bad8f355445f5a1db1cbee3cead10d8158a08c0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03248128-266f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689796873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689796873, "uuid": "9618401d-2191-4c9a-a850-6c2c2933cce1", "comment": "Malware payload (RedLineStealer)", "value": "58fc32b8dd5fecda153ec0275ac5ac85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689796873, "uuid": "3474e174-a4dd-4341-8381-279a89dba2b9", "comment": "Malware payload (RedLineStealer)", "value": "0cbd85402b0521a07025a92e87ec97859fd9c1310786728899b3981e8bc55e0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689796873, "uuid": "560ec8dc-6e0c-42ef-b797-1fb61bd2799f", "comment": "Malware payload (RedLineStealer)", "value": "02bc5d590f413c10f1846eaad45db40b425351e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689796873, "uuid": "e1d4da3f-00cd-45bd-bb1b-904b1435d7c4", "comment": "Malware payload (RedLineStealer)", "value": "8096dd3b6f041af5abf7602fbaee1c40fa9e00a075a184865c9451b60073d1709bda439e2df955ac5bf2768ce730a6d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689796873, "uuid": "4776a025-dc05-46d6-b1ec-64deb1ab08c2", "value": "T143A5D0507F18C901E5B86931EAAAC2EC4BB03C433EB1D10B6E907A8DD5747E67F09697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689796873, "uuid": "098aac11-f33a-4bef-b6a9-cf4051b9a0c9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689796873, "uuid": "6fa2ac7d-6df2-45c6-9f74-ab74aecad01b", "value": "49152:2VRZIgNvEao5vRe22qrB2f2e5OUbR1S6LPYp39U0Ul/BlnjyHIG/L5LCOPA1:2VRZIgNvEao5vRe22qrB2f2e5OUb9gp2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689796873, "uuid": "1d37a6c5-1963-4749-94e8-b004cf6195a2", "value": 2242568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689796873, "uuid": "e6efed74-0aea-43a9-91ad-55dbe0427d7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689796873, "uuid": "7859563a-e8b3-497d-902b-24301057ce37", "value": "58fc32b8dd5fecda153ec0275ac5ac85.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed5d8e3e-2665-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689792971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689792971, "uuid": "f630ef39-f793-4a36-813b-06e0d1c5f0f6", "comment": "Malware payload (RedLineStealer)", "value": "9db60a9d2d2269215a6d9f1a9a806e63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689792971, "uuid": "a01411b9-252f-4f03-8901-2904e1c80967", "comment": "Malware payload (RedLineStealer)", "value": "0cc160cb417bad64b52a563e4521a329beb776c98d8ce0850917f30bdd171f9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689792971, "uuid": "f1f0a186-f88e-4d63-bf64-04f3ce1baa8d", "comment": "Malware payload (RedLineStealer)", "value": "db1e7c8198a31d53022344e5f22ae4fb13381cc5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689792971, "uuid": "82feb740-f36f-4c7e-9636-0f913baaf00d", "comment": "Malware payload (RedLineStealer)", "value": "55f151c24adac98d6d8ff565cc919c95688ec8a70cd32025f621fc1ea5ffe07756d51ad468bd9f496fe7a0da7b9dc898", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689792971, "uuid": "55af5670-8d31-4992-8d42-d1ac30d08b11", "value": "T1BE840212F7D89033C4B6177068F647831A39BDA19C74827B37D6AD4E0873994A6B273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689792971, "uuid": "f79fce0f-4a01-4025-ba3f-e063089435dd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689792971, "uuid": "8dd52c9f-fe4e-4931-97cb-eea688f106c3", "value": "6144:Ksy+bnr+Cp0yN90QEvaXp86fn6/q4pnGZiauFGgGRHwFCcHnlRHoYkIaoHp8:oMrCy90h/qKnQ+GgGRHNcHnl9zao8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689792971, "uuid": "edb0cb68-d0f4-4f12-9a2a-af1e3e2501f5", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689792971, "uuid": "c0453f43-4d39-4d99-831b-7f7d1b804790", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689792971, "uuid": "4ed4404e-9b5f-4214-b6aa-ab75b2e6d3ef", "value": "9db60a9d2d2269215a6d9f1a9a806e63.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abec157a-2628-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689766661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689766661, "uuid": "51969ed1-fff0-4925-a501-b9cfc5349517", "comment": "Malware payload (AgentTesla)", "value": "5d9643e6404ec3e79d94a64038005dab", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689766661, "uuid": "8d5fded3-7812-41e2-96c6-494d99689a99", "comment": "Malware payload (AgentTesla)", "value": "0cef466011ca31b7a4df0482271b4e270de1b1194d0f16bcc98b391c04abd017", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689766661, "uuid": "ab58ec8e-279f-4fe5-9ead-3e1215b6e67a", "comment": "Malware payload (AgentTesla)", "value": "de8c7dd89700c1e1c94b4a72fef077c8fd6cda1d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689766661, "uuid": "f32faabb-0de6-4da5-932a-7252f7024b9a", "comment": "Malware payload (AgentTesla)", "value": "42a361410ae5ad33bf1b2cfb5f90a8d1939d2f97aea3ed0d9e660f7c45695eb0d26714552319aa3fd8f27b3726a5b579", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689766661, "uuid": "86d4b006-2ba0-44fb-a7ae-12cda16aca9a", "value": "T16CD46C9F35B8C68BE65972F074224239C9EE842F60DEE7482B24E5D816D93ED1054FB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689766661, "uuid": "9b151060-e768-43f8-9a3d-e03f3be04ece", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689766661, "uuid": "429bf3ec-6240-4c0c-92ed-35d6f5e11c0a", "value": "12288:VWmRmTscquOTvGhKv6MYRnGGMoL+f00I2ijB1kEQz:VrujOTuGG9+f00ZgB4z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689766661, "uuid": "f2329e43-53d6-49a4-8c2d-845ff0be810f", "value": 630784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689766661, "uuid": "3cffc0c5-b226-4b75-b096-b8b0a97a4b21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689766661, "uuid": "51d4f83a-de42-4b68-a5d8-b2181f5d7d4f", "value": "SecuriteInfo.com.Trojan.Siggen21.9823.11481.22265", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dd25d5c-2616-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1689758746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689758746, "uuid": "d62fa389-c2fa-43f5-b5dc-96909f927dde", "comment": "Malware payload (GuLoader)", "value": "4cf8b1f461a7915c3d2d28b976d933f2", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689758746, "uuid": "3d16aebe-47eb-4db3-8792-b7d506e71290", "comment": "Malware payload (GuLoader)", "value": "0da72cf16bf89ecd2176839e326d51f5d2d7bbcb94fcf886dfcb71b8ce59b057", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689758746, "uuid": "b5a5ed48-fbf7-4ab2-867d-fe8f9f2a5217", "comment": "Malware payload (GuLoader)", "value": "15edbb4de1ce11f1b42291e5b760717c13bd80f7", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689758746, "uuid": "9cfff2a6-5c0c-4a03-ad04-e118e4fde351", "comment": "Malware payload (GuLoader)", "value": "6eeebd1ec423d7455b38b5c6e6d77342cdd430f168c8b4ec78883c3e4c148e25c761749c69c6f6382c45dc88e142feda", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689758746, "uuid": "224f822c-bfb2-440b-bb47-e0d31bbc0c0c", "value": "T165B42382B1F5809AC8614BF58836691B0B5A9D366C34DFAF7395B7D93F321C2D80B706", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689758746, "uuid": "4be79220-db1b-4496-9817-ca58dd321639", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689758746, "uuid": "c5d1685f-8ae5-4880-af59-477fedc18c80", "value": "12288:pgW9P6ecQgjD7RCCTtoBvLOiEGykE6tKds5zYfePCCIGNgKgDt:T9Pr6D0CTmhOUGs5MGPmGNghDt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689758746, "uuid": "3fd4068b-04f1-44fd-b0cd-997204669778", "value": 519155, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689758746, "uuid": "a784afa8-8d23-4d46-8a85-4efa8cd0e33d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689758746, "uuid": "ecd51651-3088-4265-ad0c-683a0f955f02", "value": "WAYBILL.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ede7be7c-2617-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689759471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689759471, "uuid": "8079dd69-749a-4666-b4be-294c5de31d5b", "comment": "Malware payload (AgentTesla)", "value": "14bdca06382dd5686ceb348eebb5314f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689759471, "uuid": "f321c003-1e2e-4c70-a65c-245585febae7", "comment": "Malware payload (AgentTesla)", "value": "0df9fbece46ec35752c0f5dda0571b4e5909e0fba8e37e3590006e2d2d476339", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689759471, "uuid": "04d77e8c-0579-4e9e-8bf8-7be16a965522", "comment": "Malware payload (AgentTesla)", "value": "bcd2ee2bf481ccd76f1f267fe212539b8b3b6b82", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689759471, "uuid": "1d2e72f0-7ee8-4dc7-95f3-d7fb79bee110", "comment": "Malware payload (AgentTesla)", "value": "3f617b4f6a8b24c50725691b5edaa945440002d98ae7516d69f00462a9b996cac343399f4b233ae2e8a307bf343be6a3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689759471, "uuid": "4f07cf1f-03c5-481e-b579-195b8c086b2f", "value": "T1B7D423D05CE88A567B00D7D198C09DAAF839C355A52C7B157AC1E3FEBF105B488A70BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689759471, "uuid": "cbc1de6d-0ddf-458f-b2f7-d881945980ed", "value": "12288:jdqsH6AO527ukc3Hgp5rnzgtKJL6w5CrhymKEGwn7Bzy+cBL3JAy:AsH6AO527i3w18CzV3sM3h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689759471, "uuid": "b4752a09-2173-4de3-9143-eb1ecda92b35", "value": 616189, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689759471, "uuid": "66d3a0c9-8452-492b-8fad-e99fd05c8bd3", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689759471, "uuid": "79ae4236-d2b9-49f2-bac8-23d8156cafd7", "value": "RFx_ExxonMobil-Documents.xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee3817cb-2683-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689805857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689805857, "uuid": "6d8f6f9d-47c2-4733-8bad-e878d9deb2e5", "comment": "Malware payload (RedLineStealer)", "value": "79cf52a82d606b701ede22b7705dea12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689805857, "uuid": "8bcfb821-d9cc-408d-997a-654449cc86ae", "comment": "Malware payload (RedLineStealer)", "value": "0e2ca3a86d3a4b2db09378a17aa65d667bafe6227b30f1a4ba9079a439d06841", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689805857, "uuid": "11e4635e-223c-40fc-971e-d3ec9c6a5cfb", "comment": "Malware payload (RedLineStealer)", "value": "5a95a6e7962a61f350b944c0bc2e43169885d022", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689805857, "uuid": "34d3351f-7c1d-4743-9cd3-3954a6803d4c", "comment": "Malware payload (RedLineStealer)", "value": "76bc3f955595ca48390216922df9b3b6b194d8c44ddf0304cde2044c0ece5ebfe09c8c65d8b8e7a836e13869d641b9dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689805857, "uuid": "2979e721-7910-4e30-85bd-ba7425ba4300", "value": "T1C9E2F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689805857, "uuid": "b0c9ad5e-053c-47bf-b22a-bad7c70848df", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689805857, "uuid": "5aaf5f32-7e78-4ae8-84ce-c0abb47c83b7", "value": 31274, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689805857, "uuid": "33dfa8f9-a605-432e-bbe9-c7265ecaade8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689805857, "uuid": "cee07430-625a-46d4-89fe-d90324f422df", "value": "79cf52a82d606b701ede22b7705dea12.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad70eafd-2632-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689770959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689770959, "uuid": "28ab5f30-0827-4596-a14a-95c8fff3136c", "comment": "Malware payload (AgentTesla)", "value": "12b7ebbcd4578dedb5b0d7241a5f7f0b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689770959, "uuid": "625fd12a-7875-4889-b9a4-330defacb8f9", "comment": "Malware payload (AgentTesla)", "value": "10c3ade35a4335bd3c404789a75cc98b4b28a12468db7f8fd6e94d468e0bad7e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689770959, "uuid": "b4383e3a-ee1d-4ef6-8db4-123386981b21", "comment": "Malware payload (AgentTesla)", "value": "9b617575503d747c1255317ad2b291ecb32060dc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689770959, "uuid": "69a9abb4-907b-463c-8b96-7286294c090e", "comment": "Malware payload (AgentTesla)", "value": "57a71ea03c49267ee3e6a22397a933b2c6ea4862aeed4e38c567c42f8dcb2972ba65b3673d849912f22ebcf1588a3293", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689770959, "uuid": "01008cc1-ae08-4d73-869c-6dd650e1fb65", "value": "T111757B03B65686F2E2891B36E79B5804C361CE83733BE70B7D4E33A559133AA9C46D17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689770959, "uuid": "674f02e8-ca4b-44d6-8745-09b01be1f6d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689770959, "uuid": "63cac5b3-1b94-4ab4-8e18-e3ec283ba3ee", "value": "24576:PREcQ0LX53K06pdoTYG3ei3yZ2IQwfMwhhjEt/XSmNeI6b/Ry+Si4tyktoOYMKGl:H5CpdHGURhhAx/v0itPiOBKGl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689770959, "uuid": "0e5e5b04-3d10-4dbd-b26f-86cc2bfb5a6e", "value": 1663992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689770959, "uuid": "40b3d5a9-cd8c-4571-af99-d802bd9c267f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689770959, "uuid": "a3feba43-b6f9-4de0-9151-0e44eb859cb9", "value": "12b7ebbcd4578dedb5b0d7241a5f7f0b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c4b3154-25e6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689738154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689738154, "uuid": "bf095d39-613b-47cc-9a16-c11cd4cdfa03", "comment": "Malware payload (Amadey)", "value": "ee5e79d00a13fde9e96a1f9953f35fea", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689738154, "uuid": "0298a3bd-8cd8-453d-a155-307f7c81e89f", "comment": "Malware payload (Amadey)", "value": "10f472a1b5799a09ae60fd901a10125c8eed6220bdbed49cfa301962e7972837", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689738154, "uuid": "a63214fd-80dd-4bce-bb25-5641730842bd", "comment": "Malware payload (Amadey)", "value": "788be8b6304f138f5c7bdf00fe98562de6f2790d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689738154, "uuid": "f7549970-2579-4c76-9000-d406bddcaf5b", "comment": "Malware payload (Amadey)", "value": "9a0199cfed9ed714f414856af1c6e14ef5fec37d48afcc6027439a18d5720344d5579b5e3bee929d69186215be9c2e7c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689738154, "uuid": "ebc6a1d1-4fe5-41c1-bdc1-41f85a955dca", "value": "T17E34D002A7E85473DDB5177058F703C31E36BCA1AAB8836B2756A95E0C73684B47237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689738154, "uuid": "f63d1471-d972-4f58-b64c-d331a76fd394", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689738154, "uuid": "4acacffa-ff20-4a0e-8e1e-50d18f8d51d5", "value": "6144:KCy+bnr+0p0yN90QEdHyEL9MR1SKgfYLNYs1Ul8C2N:6Mrcy90zgoYLWs6l8V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689738154, "uuid": "6f70432b-bfd1-446b-8574-7dab112848d4", "value": 240640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689738154, "uuid": "cc3593e3-7f2b-4e92-9b78-8f05a2e1cc52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689738154, "uuid": "262f3172-cfa8-4dfc-b51b-9980e18610c3", "value": "v7229391.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31a79ea8-260f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1689755719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689755719, "uuid": "110e94ee-15ba-4936-b09a-f26ff98e9b89", "comment": "Malware payload (DCRat)", "value": "bb6a2d8e7ce1d1747f5feba71c756843", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689755719, "uuid": "896cd3ec-1e7a-42ac-859c-9298af754555", "comment": "Malware payload (DCRat)", "value": "116e97fee9e7e223ac40e057e55bc63f53a002bff3427341a782418ed0f8fed8", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689755719, "uuid": "c7ea3358-b9c9-4225-b72c-619a5ecc0203", "comment": "Malware payload (DCRat)", "value": "1e21bfda2831d10950bf736b1a6e84e05924caee", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689755719, "uuid": "25240e06-3af2-434b-a90f-294842a0cb2d", "comment": "Malware payload (DCRat)", "value": "8c8099dbf3382dc2674f689379a4d0c55da9cbf6ca8e7cf6f6a88af05858125d45a6867785adf87ad44788f30166d1ad", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689755719, "uuid": "691caa54-ab53-4e82-baf1-1caf017bdb76", "value": "T1483506127AC4DE02D02D163BC9DF962847A8FD4236A2C71B7E9F3B5C25563A70D1E1CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689755719, "uuid": "c49c13b5-d619-44a9-ac36-4163ba4affcb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689755719, "uuid": "80850cc0-e43a-4094-9dea-253f46ac2d28", "value": "12288:+P07VIp/L2R23wAiMtX/ekcf3sHTlFtAT/8GIYbCJb2ex9tfV9IfsQ8FJ7uqn4:+P0Z+yIBX/ek4szaejtf3z7u+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689755719, "uuid": "1f483b17-ed6d-4267-af10-46878fe229f9", "value": 1097728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689755719, "uuid": "a75a8a02-c8e6-45b2-8802-53a06d4e9bf9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689755719, "uuid": "98188896-2397-4e6f-9c7a-e748002743e1", "value": "HEUR-Trojan-Spy.MSIL.Stealer.gen-116e97fee9e7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21452634-25f8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689745813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689745813, "uuid": "6ed70838-3918-4aa5-b58c-565482ded3fa", "comment": "Malware payload (AgentTesla)", "value": "60c9a27fd72d657ae6c6c6454fae67df", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689745813, "uuid": "91a02831-add7-4b53-ac94-adc0fa025bc9", "comment": "Malware payload (AgentTesla)", "value": "11ae74e0f3d1fb2223c427ff54336d86d8a73ce691c2cdc8d13e7f5c8ba730ac", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689745813, "uuid": "c9e183dd-b224-48c8-b4a1-aedb57dc84c0", "comment": "Malware payload (AgentTesla)", "value": "8eabdd8bc84a3ee381960b63b56dd9d907ce5ebc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689745813, "uuid": "b06da5ac-7e05-44db-8c56-84af1b62eeec", "comment": "Malware payload (AgentTesla)", "value": "a35beeda56ee75cb7f7cfd6b5c02b8494026761e7392dcb8b45b3ed10c2c7cc10e4b546e6084d4242268bc54ca7f419a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689745813, "uuid": "f500e9f3-c10c-44c8-adaa-2641c229d957", "value": "T19D327DBF58D869AFF327F0B740542144F6A433D3532ADD0A7A70BA6CC5B11CE5A122DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689745813, "uuid": "0f3ee163-8569-434b-8321-cde8e8ee35f0", "value": "192:sya0NKWPQWOARgZVPCK44AG9xXSJ+Ej7oJY+Kw/Ki/MWYYcWeRA:syXKWPQWOANK4499xXSJf7oJY+N3YYoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689745813, "uuid": "8176f371-2934-416e-b8bf-4c39c73559be", "value": 11085, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689745813, "uuid": "e921fb37-2a57-49af-9e39-2ea16a12b27e", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689745813, "uuid": "c8e0862b-78ac-49cb-b6b1-065f6728e270", "value": "Total Tunisia Request For Quotation.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de0a34cd-2637-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1689773188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689773188, "uuid": "179ea988-d6db-4455-9246-5d38339c1017", "comment": "Malware payload (GuLoader)", "value": "ff7b2f27f9a663600598cf46aca51018", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689773188, "uuid": "927f70f2-5489-4780-a376-a0ad63d10792", "comment": "Malware payload (GuLoader)", "value": "122b95dfe9c2ec1562ee9f6348878b3040f72b497d28875403ecd1a2191c4013", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689773188, "uuid": "3120579b-404d-48e6-8c20-27d020631db1", "comment": "Malware payload (GuLoader)", "value": "50719776bcee601c80c68c1678497a031f75802d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689773188, "uuid": "e7945ad0-328e-49c2-a07d-a218e7ee6925", "comment": "Malware payload (GuLoader)", "value": "a8d2fef4a3a2da7f5344c8a5b57295df76a033dd69ef2163dd6efec92cd29b27db170dcdc4ff76b670a754f5657114b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689773188, "uuid": "cafd5693-6a1e-4193-b5ff-e55f36627128", "value": "T118B41261679CC527C96117B01D62B95A8AF0CD10AD72EE0F3319792C3BF12D6AA1F327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689773188, "uuid": "85ddbbfe-2c86-43f8-aee9-54ae1f5fbf64", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689773188, "uuid": "8f84abc7-c554-46be-8a6f-052477078925", "value": "12288:CQIaOSeH6cvIJwiSyRa02NUg5cyBIfnQhbD3:eJ1gRaPNUZVfQhbD3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689773188, "uuid": "4072543a-3dc6-4d29-959e-2eaa2963fb15", "value": 520823, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689773188, "uuid": "83a8064a-dbe9-41ed-af80-73f9225eef80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689773188, "uuid": "ecb1858f-fd77-463f-a47e-731283156102", "value": "PO4811_35(PNE0019P23).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15e9202d-2621-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689763403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689763403, "uuid": "8acc3424-15b2-4a92-99c6-ae1af6d3839a", "comment": "Malware payload", "value": "73a6f6d1b3cb0c77fbdd05559cb17965", "object_relation": "md5", "Tag": [ { "name": "htm", "colour": "#8E475F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689763403, "uuid": "e06338d5-85a1-4795-8ce3-7d6d6bdc9ef7", "comment": "Malware payload", "value": "12a33f9915090235e799e81e287c7ada60ec83325d83a35a1a1dfd335ba966f2", "object_relation": "sha256", "Tag": [ { "name": "htm", "colour": "#8E475F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689763403, "uuid": "3b279d79-8c2d-4a1f-b5b6-db99dfe7c971", "comment": "Malware payload", "value": "8e8a4201162acae7ccf9c3cbff1817673d6ad723", "object_relation": "sha1", "Tag": [ { "name": "htm", "colour": "#8E475F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689763403, "uuid": "5984640f-f85f-403a-9231-7d662c185f5d", "comment": "Malware payload", "value": "f8221a8aadac5059830ba88fed400df3f8b5895c19f9b2fc690cd12a803377ce1e27e61d7f24f0cb582f30fc6bbbd5cb", "object_relation": "sha3-384", "Tag": [ { "name": "htm", "colour": "#8E475F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689763403, "uuid": "515729ce-1e05-452f-9bcb-5d5b54752014", "value": "T1B9929E1B9D326CB1CFB4450724E99BDA925279608D531CB8722ADBC457EFDC396420CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689763403, "uuid": "fdc9dd19-0836-4060-893c-163b127d74df", "value": "384:JpfVwRWEShvyu2y8eWmkALcC76WsyU8HYoDNWVl1ROYjIgsRxmwvSDH7yal:JV+FyvyryKpGwF84Gob1xcFR49Dbyal", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689763403, "uuid": "9fac4573-a7d9-4ba3-813e-2d1a1ddfa372", "value": 20444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689763403, "uuid": "077f18c7-fe91-4e73-a53f-fa489055efd6", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689763403, "uuid": "4c3bc52b-9689-4019-b3ef-6577fdee94cc", "value": "ATT868089.htm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14b50fd2-2626-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689765549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689765549, "uuid": "f1fb4524-618d-4b63-b335-88d1475bc170", "comment": "Malware payload (AgentTesla)", "value": "cc47323a812b42250d34573c4b9f12e0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689765549, "uuid": "3899c9a3-ed0a-46c6-b24a-4f3195db691a", "comment": "Malware payload (AgentTesla)", "value": "1646017b8052c3ea33881beeb6c7e7755567eaa49c4eb2df8e7d89496af01f7d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689765549, "uuid": "0adc4bb8-7d9a-4c0c-bff4-fe3351361d88", "comment": "Malware payload (AgentTesla)", "value": "2af65a3a53f0a39fe33c17aa43698c2d1a0bee61", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689765549, "uuid": "fadc27ca-8253-47fb-988a-f830aa22c88b", "comment": "Malware payload (AgentTesla)", "value": "94f5e17fc71790e047785459a0d7614036ccf805439227ec66a5e5680082890e97ef484963d3de0992345c3a3796ce3c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689765549, "uuid": "585a0f64-338b-425f-9fda-1faef1b83b11", "value": "T1CB037E5EE79F02A48F4103B6271B0E8896BDB22DF35555B138AC937433E9C3D06666BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689765549, "uuid": "1eb3ccff-724f-4ea0-9f71-3d4c489cc567", "value": "768:oFx0XaIsnPRIa4fwJMrhv97Lxub+x034EWa+fBV8kH:of0Xvx3EM19HxubBfWRBykH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689765549, "uuid": "72fd70ce-5a1e-4f62-a203-83454bd158c5", "value": 39955, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689765549, "uuid": "a859601e-ec5c-4542-b8f5-91db34a90e4f", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689765549, "uuid": "4636e2f6-801e-409c-a1a7-d0a72cbe3a4c", "value": "KSYXProductXCatalog.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ccffeb1-25e6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RanumBot)", "timestamp": 1689738048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689738048, "uuid": "ab7a13b5-21a4-4b5e-a8d2-c66822797db7", "comment": "Malware payload (RanumBot)", "value": "8e67f58837092385dcf01e8a2b4f5783", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "RanumBot", "colour": "#910B82", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689738048, "uuid": "96046d72-59ff-43d8-adad-81fb4d0c4f04", "comment": "Malware payload (RanumBot)", "value": "166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "RanumBot", "colour": "#910B82", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689738048, "uuid": "41b0aecd-581c-4bdc-9e26-826448e232c3", "comment": "Malware payload (RanumBot)", "value": "012c49cfd8c5d06795a6f67ea2baf2a082cf8625", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "RanumBot", "colour": "#910B82", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689738048, "uuid": "e7f57cde-cec3-435a-b8b9-cf43fe04c03a", "comment": "Malware payload (RanumBot)", "value": "f0e4a8499ab558b5e74d85f0e2d03c3d8517ee277fa2b679aefb188a28df71105d1118d763ea3b7b069779f28bd099e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "RanumBot", "colour": "#910B82", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689738048, "uuid": "6600d435-0d65-4326-827a-7e98711d0139", "value": "T15EA533A7C7590897E89919F75497103EF28BE740C43E04BA73FF097081B6ACB6267792", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689738048, "uuid": "dfe3f1cb-b729-4bdc-811b-0e58b2e18f7c", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689738048, "uuid": "f4a542bc-27e7-4e0e-845e-f821b5ecd555", "value": "49152:y+SUiJeHpNnxG745Mfi39uXrbcI6DOdVgeuaNjwAx1bJljkv6kXjxNh:fdlHA4yiN8cI6SX3hbJCvhx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689738048, "uuid": "6b2b72ad-eb1b-4d26-acf3-7e5f02911e70", "value": 2103296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689738048, "uuid": "e2822894-fc08-449d-8dcf-b5ab5e666b89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689738048, "uuid": "1f113033-9388-4682-9077-09482719d7a0", "value": "windefender.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8998c26c-262b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1689767892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689767892, "uuid": "fcc8ef44-4d5d-44a8-ab74-c371a5d8efcc", "comment": "Malware payload (DarkCloud)", "value": "56aa5336bc3838a2bcbf9b3f44f2f2bd", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689767892, "uuid": "0752a391-a684-4da6-96c7-4cfa8fe99705", "comment": "Malware payload (DarkCloud)", "value": "16bdc0c558c63fb3cfe920de4b08fde88403587e6a3080a600ee027b2272ccf1", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689767892, "uuid": "8b608093-5f41-4202-b7dc-71cee950bcda", "comment": "Malware payload (DarkCloud)", "value": "6e9c9f628d93b3ed0e4d8d892515b59b2bd8df6e", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689767892, "uuid": "98a65e2a-05c4-465b-8d49-f8948f0d0df7", "comment": "Malware payload (DarkCloud)", "value": "0a397b86da29ed1d6a24c676ea9ca134c5f246e74d2f31fc3da101f048684c32e5aa9be105a69b02ab7a36466eac6e33", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689767892, "uuid": "6a79b911-61d8-43bd-827e-faa75631cabb", "value": "T1CB0533232ACDF81FCF01D9668A0DCEDAB9831CD71908F99E67C95CB599462B1BEC2105", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689767892, "uuid": "92bc9830-0771-4c7d-825d-9750bacfe4b6", "value": "24576:r1KRd5tVQv/u1qQ+0hZTbNF0ZiiDSt/odV7:8tVQnKqQrhlbN6ZiiDdP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689767892, "uuid": "bcc7b145-727c-44fc-97f6-8b1feda1e3ac", "value": 819136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689767892, "uuid": "c231c27d-cf3c-409c-ae9f-80df5065f03e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689767892, "uuid": "d9da318e-10d7-495d-9a0a-4a4d9ff3c659", "value": "Remittance Slip -4,324.62 C42237.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a901f68-25fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689747547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747547, "uuid": "49331412-a511-4d5a-b0aa-d9af1514cbb6", "comment": "Malware payload", "value": "3a69847fe1b128253a969c1373d33762", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747547, "uuid": "ba157857-cfb1-48c4-88f1-05962e9944dd", "comment": "Malware payload", "value": "17b16227b52916637764d98db53650b5b61daaaf818735c2ba5083427e540479", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747547, "uuid": "e469c21d-d89c-478f-9a15-c54e1cf10252", "comment": "Malware payload", "value": "a399f501ab451a342f626892d624cb7dfe8f872b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747547, "uuid": "3a7317c7-84f2-4caa-a2fe-120ad50dbc1c", "comment": "Malware payload", "value": "023d015743dae3685becb989557490bce6dbc2440e271b2f3683a35694593d116141f5556c23c316a4febf854f23592c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747547, "uuid": "d788134d-a679-40e6-970b-3aad77732d40", "value": "T154F3AE53F6D88072DDB917B008FA02C30B35BCA15B7893EB5751A99E4CB26D0A93177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747547, "uuid": "889cc1c9-4f1e-4a37-b9f8-25536138ae69", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747547, "uuid": "29c4929e-6dc1-445b-86eb-a5396385b47d", "value": "3072:RD/Ier13d5GWp1icKAArDZz4N9GhbkrNEk1DiWZv1:1Iexp0yN90QEwii", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689747547, "uuid": "ea5ef092-5d45-4592-9b88-b0042ac9531a", "value": 159436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689747547, "uuid": "ade73bc7-33d7-4d4d-a399-09832b95335a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747547, "uuid": "7c402c43-b398-49b0-bfc5-6df999b7bd36", "value": "3a69847fe1b128253a969c1373d33762.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f49ad39c-2634-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689771937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771937, "uuid": "82d5d53f-06f8-463a-99c8-5c293cd1af26", "comment": "Malware payload (RedLineStealer)", "value": "edb445f9be40df9417c06c4059aebd1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771937, "uuid": "e7c43914-592b-4b24-a235-82a13aa8f8cf", "comment": "Malware payload (RedLineStealer)", "value": "17da5ea13f6ae0c05dd9f47258b06ec62249dedab36ca2245f1e4740e9b9df39", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771937, "uuid": "a158af93-f711-4ee3-8a8d-387df3de066b", "comment": "Malware payload (RedLineStealer)", "value": "9588890303be2a21dea72c0e6131202d379f78f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771937, "uuid": "0a5212ad-86bd-4ead-8f3c-932beda46396", "comment": "Malware payload (RedLineStealer)", "value": "8bc5965ee69e860bf93d846603009a1492b3776a310557c6329cd0f062778721666b59c8a86601c57290473681f08a21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771937, "uuid": "f0237fdd-ad06-426c-80c5-cfc25b0f0a08", "value": "T1C6840112B7D59433D9F267B048F603930A3ABCF25DB8931A2755A91F0CB3690A93177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771937, "uuid": "a553b121-9f21-43b0-8824-3ff3a170a1a0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771937, "uuid": "8a98c169-8282-406e-b06a-8e6bd3c09c36", "value": "6144:KFy+bnr+rp0yN90QE3C0jlTaCbV2oOXdKqJcHZ7WCpgFzREvg8ZWTjfX3QSmrV:DMrby90VxjlTJ9bquRpgFzRWjWTjvgr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689771937, "uuid": "26a8c886-6a3c-4c74-a8f3-2c77c2ea3fdb", "value": 397824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689771937, "uuid": "1de2e7e6-9128-4810-bc3f-a5184b666202", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771937, "uuid": "a0ffe1ac-c4f0-4d5d-b90c-e451c4bdc999", "value": "edb445f9be40df9417c06c4059aebd1e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61938c73-25ff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CustomerLoader)", "timestamp": 1689748927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748927, "uuid": "6eebea43-306d-478e-b69a-9cdd219fdcc2", "comment": "Malware payload (CustomerLoader)", "value": "b45a0c05a57b21cab1dcb6d58bd99f83", "object_relation": "md5", "Tag": [ { "name": "CustomerLoader", "colour": "#57A5C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748927, "uuid": "cf0afdba-af09-47e7-80c1-e9261c7bd87c", "comment": "Malware payload (CustomerLoader)", "value": "18aa945b3f83c4634612a2192fd6d7cec0a3601849d76b38a95b240d8d2d6faa", "object_relation": "sha256", "Tag": [ { "name": "CustomerLoader", "colour": "#57A5C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748927, "uuid": "e6a8413d-7ccf-44be-a56c-798f6a8879b9", "comment": "Malware payload (CustomerLoader)", "value": "8ba0cea4a53b0582abbb98bb25ea47d1c857bbb5", "object_relation": "sha1", "Tag": [ { "name": "CustomerLoader", "colour": "#57A5C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748927, "uuid": "4ee8581f-4d66-46fc-a531-4392347272a5", "comment": "Malware payload (CustomerLoader)", "value": "faf7e7b67fb34d33119d61aa153e8a1de7407da854622b383d17bcc3bbc9e6326932fb214c73786b9478680e81b0e85e", "object_relation": "sha3-384", "Tag": [ { "name": "CustomerLoader", "colour": "#57A5C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748927, "uuid": "54211094-1d80-4d26-9753-ba134550f7d2", "value": "T16303C00407A90171D66B077CDCE103821B7A1FA7E867EF5FEECC968A1D4332967226B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748927, "uuid": "bd1e3382-c1ef-4094-9ab3-fd9bc196ead9", "value": "768:Fln/NhS5G0b6+2s3M2F7Tllmu24Ra2DovIieNhIPVQPaSB2:Jh8G0W+2B2JTll92m7ov0oWxB2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689748927, "uuid": "f08ead72-8c5e-46c7-a6cd-7d24e8993f5d", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689748927, "uuid": "fc61b7d6-5533-461f-baaa-e8dbb81de9c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748927, "uuid": "9812ae6e-e939-4cd1-a276-e17ebe56afd6", "value": "b45a0c05a57b21cab1dcb6d58bd99f83.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88ec2903-2611-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1689756724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689756724, "uuid": "cef246a9-e9d5-4df5-a1d2-dc2d9d99d5a3", "comment": "Malware payload (Formbook)", "value": "7f35dc7cd9eeb7254543905f7ac915c7", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689756724, "uuid": "590497be-92db-436f-9d49-7f7bafecd483", "comment": "Malware payload (Formbook)", "value": "19915399b192ab9b2fff5e466e1dea38b03a29ebd8510d704f0fe5b7fce077f4", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689756724, "uuid": "7107a849-4c6c-49c3-bf8b-ed668858401b", "comment": "Malware payload (Formbook)", "value": "8ea2f6eb0975883b797f984be3412fc5af853193", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689756724, "uuid": "01993e03-a625-41c3-9040-f6c8798a3d23", "comment": "Malware payload (Formbook)", "value": "20ccb87ba61ea3d1a12d81645aef71961327b8d07c02ddc5763e340fa64515c97f8fc9b6b01caca1c8e795a1b26283cb", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689756724, "uuid": "e08b0d1a-7450-4a47-824f-9416bb6791a3", "value": "T125D423768D340072C984717BD8F68EB756A724ADB89344A8595257224384CBDCF8E3EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689756724, "uuid": "081133da-1f23-4755-898d-825edb0b7556", "value": "12288:Zn1VU6g5vrpiar3DBZbd1eeQVkfwHcLqYItnTtJBtspdOiQ2y:Zf8l4Q3vR1Djfw8OFtTtvtsnOgy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689756724, "uuid": "be5973ed-d4ff-4993-9531-e28d2b045c5a", "value": 604061, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689756724, "uuid": "e12dfbc8-338d-4c13-842f-81a7b3bc1f18", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689756724, "uuid": "19eb3e3f-8316-443d-9805-f2557818baca", "value": "DHL Shipment Delivery Notification 18-7-23.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "085d9415-265a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689787862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787862, "uuid": "711bc37e-886c-4949-8847-24daffc0d10b", "comment": "Malware payload (RedLineStealer)", "value": "db8257e8ab169ad070aa31346e81e22c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787862, "uuid": "dbddda6a-7c28-415a-97f7-c1a688ba0b7d", "comment": "Malware payload (RedLineStealer)", "value": "1a18d77416ce6659396798665715800988069ded3452ed7d9963bd332ef7d418", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787862, "uuid": "a9632276-2255-4374-8464-920b904cf9d0", "comment": "Malware payload (RedLineStealer)", "value": "a75c5ed05828e64d00f0a2a350b06e7e9ee4b14a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787862, "uuid": "8b8bc63f-bdcc-4f53-9f77-5e75ca38caa4", "comment": "Malware payload (RedLineStealer)", "value": "70b801012cbd911a75bdc857b8a2aa957a71f29f96dc4f23faa290b309ad6c081bca8691cbb6d483f4b5b046937048b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787862, "uuid": "48686f91-fed6-462c-a64e-7ff5beee286f", "value": "T1C7840113F6DC9033D8B52BB068F216830B3ABCB15D74826B2782A94E4C73585E57677B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787862, "uuid": "cbaff664-3d2d-4584-9112-b2d218cef162", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787862, "uuid": "b748c93b-79c6-401a-b30f-9fcc91890aef", "value": "12288:TMrmy90LnhBTfNDc/fHD4tua8HCcHnl9qDd1/9:5ySnN4XmjQxHal", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689787862, "uuid": "68cc5482-9997-4322-975f-9ded562b1352", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689787862, "uuid": "98aea345-22b4-4270-ab62-eb09829a7ed0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787862, "uuid": "bf65d068-6c29-4ff2-ae1e-b7371a0f1c19", "value": "db8257e8ab169ad070aa31346e81e22c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57277a11-2632-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1689770814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689770814, "uuid": "46124c2c-8c20-47ef-b565-5f46a727b62a", "comment": "Malware payload (SnakeKeylogger)", "value": "23e2e7bd3d1d30d4881b382d10a54c9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689770814, "uuid": "8707d301-e114-4895-950e-31420eb6bbdb", "comment": "Malware payload (SnakeKeylogger)", "value": "1a1c58b80969ae187cde83fd32586d6072f8b66eae0dd3ae81c7b0d015d5c308", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689770814, "uuid": "346bba22-c17a-4207-be1f-76b7a5bde243", "comment": "Malware payload (SnakeKeylogger)", "value": "a75a3fc37c081a8e36eb46a64d1673e541369782", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689770814, "uuid": "3d8f3acb-888c-4826-adcd-816382e8d5ce", "comment": "Malware payload (SnakeKeylogger)", "value": "58e70eeaad1da48b154f08ab220f6149340a47cceca4785c9bd39e6a1234d6ca5ef9854a6b60cbeb041541e1a8a8ca65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689770814, "uuid": "11d5ddd2-ca1b-4a2d-9049-ff5ac432503b", "value": "T19CD4120039B88B13C6A48BFA0691674513BD5FDD2065F55E9FEBECD6B2B2F210A40D63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689770814, "uuid": "8b6b1930-41f0-4ca7-a212-26d472995b6f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689770814, "uuid": "33541654-405a-4383-a317-9b4d6d80e7eb", "value": "12288:pyPYPfY7hJGELu3yqwhy5kD8KeNjIqhlVSKZ2jv:MPYPgXqCqwE5uze+qfD2j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689770814, "uuid": "c8f7f942-4d06-4e8d-b217-072924b060fd", "value": 604672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689770814, "uuid": "99912ff7-d62d-4637-8640-753671002869", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689770814, "uuid": "76cf630a-e0e5-4e87-83b8-8fff8c8766f4", "value": "Confirmaci\u00f3n de transferencia.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f5cf0da-25ee-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689741569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689741569, "uuid": "fed82379-732f-458a-9771-5574fe7b6b6a", "comment": "Malware payload", "value": "47eff959df19504cf592bc0cb19aa0df", "object_relation": "md5", "Tag": [ { "name": "aigoogle", "colour": "#EFCB28", "exportable": true, "hide_tag": false }, { "name": "intellithinkhub", "colour": "#F99C3E", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689741569, "uuid": "9dc97bcc-b944-4633-b379-f05668f4f820", "comment": "Malware payload", "value": "1a2916edd29aa2a1f8b86d9da722a4213b97fc5c1e2e9eb15e0e90dd9ceacb72", "object_relation": "sha256", "Tag": [ { "name": "aigoogle", "colour": "#EFCB28", "exportable": true, "hide_tag": false }, { "name": "intellithinkhub", "colour": "#F99C3E", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689741569, "uuid": "7eec594e-821d-457a-9727-35c5f676e97a", "comment": "Malware payload", "value": "dd80f9caec1ee664f773010687a78e32e91698d5", "object_relation": "sha1", "Tag": [ { "name": "aigoogle", "colour": "#EFCB28", "exportable": true, "hide_tag": false }, { "name": "intellithinkhub", "colour": "#F99C3E", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689741569, "uuid": "b94313a4-cc36-4ab9-8198-f36df16b9643", "comment": "Malware payload", "value": "b8797f80a0ae8108180f971ce0063078248fe4797a5cf4d2447ad6f7308675fd380d6d5234e8ddb61015c731397bc49f", "object_relation": "sha3-384", "Tag": [ { "name": "aigoogle", "colour": "#EFCB28", "exportable": true, "hide_tag": false }, { "name": "intellithinkhub", "colour": "#F99C3E", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689741569, "uuid": "006969c1-0719-4596-b74c-bfc7951b1156", "value": "T13A46334BB8CB1F36D12947B5609F57CA9F685E040B47062773FB728438B37187AB849A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689741569, "uuid": "45f5c7c1-b27c-44ff-856d-732fbef008a9", "value": "98304:1hWMy2eOSmUNQiveS0nGRehMc6zEmktLFt7s365qqXxHw+v+y3hfHDdu7gQD:1hWMyLOiv4GRemc6zEVtBt7Q65qqXxQV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689741569, "uuid": "637732c8-d029-4311-a3de-d9ce62d57a8c", "value": 5881344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689741569, "uuid": "f042b254-0719-4b12-9f99-9315d8e8da6f", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689741569, "uuid": "b8b71326-f526-4696-8d37-77f2b41db44d", "value": "Setup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78faa8c8-25fd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NanoCore)", "timestamp": 1689748108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748108, "uuid": "63a83ab1-d8e8-4f3b-b4b7-ddee7bf1b8c2", "comment": "Malware payload (NanoCore)", "value": "9ce4595ef4f1e7df096107dad4eee1cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748108, "uuid": "c577ae99-bb3c-4a52-9b4e-c38775425060", "comment": "Malware payload (NanoCore)", "value": "1a702b05be292c710cbb70e76baf677538bd150593433fbcb435612e4d65d25e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748108, "uuid": "ea2547f3-c122-41fb-b271-a222150cfa7f", "comment": "Malware payload (NanoCore)", "value": "82173701c6f4b36311d9174d9bcef815e4cc815e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748108, "uuid": "ff99f944-deb7-4fc0-b9de-c11b77893ce8", "comment": "Malware payload (NanoCore)", "value": "3bbc99d5e84a2a0995f0a3aac85981ec0dc9661987bf1a07068a820076922e84ca06f8254efc144913b009611bb92309", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748108, "uuid": "9ffa9f0e-9437-4fb5-b0f7-1a2e5c1a5cfa", "value": "T152A59D03BA76CEBAE15917B7D5B678048F6DEE82722BF60A344A33551C3376A9C01D07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748108, "uuid": "fa828ab7-e1b1-4ed7-9d6e-225d0c377298", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748108, "uuid": "c9646709-f7c2-41a7-85e5-23be9632fa98", "value": "24576:qcEzT9n/lZ0aAGdRNTPDX4F17RyFAxqRGPjIOxxujzpNa6o02LKUpvB6lpykqSI:sIjAlX4F17kIqANzujznSKUpvQyk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689748108, "uuid": "0c8016d1-648c-4905-9dc0-ca58dbd42b73", "value": 2101760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689748108, "uuid": "063b8b72-d269-4e0a-a530-bddc3f602f1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748108, "uuid": "1cdfe3a1-8476-4a1f-964e-e54ee82d76da", "value": "fatura de pagamento 23007 -- Boleto Banc\u00e1rio Transa\u00e7\u00e3o.xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5de75db-2625-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ModiLoader)", "timestamp": 1689765363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689765363, "uuid": "5b0c6fc8-cca6-4a73-9115-b5ca90e325a7", "comment": "Malware payload (ModiLoader)", "value": "405cdd4f0226c893e626931ca7096f5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689765363, "uuid": "245732f0-a7d7-46cc-bda4-c1f56efd5baa", "comment": "Malware payload (ModiLoader)", "value": "1acecc1f245ab45378418be82fc87c3742529ded1d291c7dd08c04136b6be1fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689765363, "uuid": "ab2d5b6a-2cde-403b-9ed2-90b964946a3f", "comment": "Malware payload (ModiLoader)", "value": "1b725ec56c2ae3906c985ea01fd99b73dc301642", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689765363, "uuid": "742dc7d8-bfe3-4a7a-a0e6-804262bf8b9d", "comment": "Malware payload (ModiLoader)", "value": "14e3011ccb6ae81e51334fe2899eb6fe6dc37426d475ff5807e33186fc68b4e4b9de5ca92a9c970895caf89071bffecd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689765363, "uuid": "46b916a5-b005-4665-bef3-e0b19b5e9252", "value": "T1F315C012B2E08473E69F3D388C4ACB5654257D212D28F5CB76C83ECCE7763826919D6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689765363, "uuid": "bc3d89b9-60a9-4f7a-a9ab-b9ceb0a3bd8b", "value": "5a228192c4ccf136d4c97f1d42c75f4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689765363, "uuid": "db13e743-66d7-475a-9a21-345ea09a1ab7", "value": "24576:qgVL/HkvOe7zm1OHMVy500RNJn13NsP54J06:5lMGaNbbJ1Nc4+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689765363, "uuid": "dfbf461c-1346-4434-8362-0bb31a4518a5", "value": 880128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689765363, "uuid": "bd5046b0-a40f-46f1-a197-a75c2375f145", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689765363, "uuid": "43136be6-403b-438a-b60d-2a6703e8512d", "value": "Documents f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec0a77ae-260f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1689756032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689756032, "uuid": "33619db6-9278-44aa-a504-352bc4d9faf7", "comment": "Malware payload (DarkCloud)", "value": "6805fd6352be5392b992b0b76a9602a0", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689756032, "uuid": "cb33d448-33dc-4b52-a524-f13b1f32f281", "comment": "Malware payload (DarkCloud)", "value": "1bc9ca07c3aab1a4048367c74928cd596eeca3b2e22c4dc30de68e8c727357e7", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689756032, "uuid": "240cfbc9-d2ba-4f9a-a801-c28c4e06b311", "comment": "Malware payload (DarkCloud)", "value": "582e4b41668690d72cd42690d2e395f3ab4b484a", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689756032, "uuid": "171823cb-4d8f-4534-b3b3-a754d384157c", "comment": "Malware payload (DarkCloud)", "value": "4aeb3ee88ac1f8bbcf3914b18ef9caf468d9328fc96f10f6c7300f6ff8bdfecf63ccfba28ef00744ef4e2a078f78cb02", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689756032, "uuid": "12d77607-9d2c-41a5-a024-fe069202c29e", "value": "T1E5527CB5C4B93039C74A89B8F4635A09F3146F93B3390AD12EF8EE6495F55CB2B09349", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689756032, "uuid": "4da2e528-e6d4-4a33-9ae7-6265d68b1193", "value": "384:dvoPn5jpcnFU4XyWA9JYc9xx0Q455+I/igoEYymCb6Hx:63cFRgPieBR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689756032, "uuid": "6d844821-3755-40bf-9096-acce0df39d11", "value": 13432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689756032, "uuid": "3f0eac7e-8f17-4b79-a4b8-d1c18ab8ef86", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689756032, "uuid": "dce26b92-2969-41fb-9add-b86a7e1e994e", "value": "Sales Order.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77937c49-25fe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CoinMiner)", "timestamp": 1689748535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748535, "uuid": "a4ec600d-a9de-477c-a76c-fbb02f0a2179", "comment": "Malware payload (CoinMiner)", "value": "dd4b52f33373c57093f1df396a76e058", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748535, "uuid": "14b1072e-8aa7-4403-8326-39727c0a8693", "comment": "Malware payload (CoinMiner)", "value": "1c49d7da416474135cd35a9166f2de0f8775f21a27cd47d28be48a2ce580d58d", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748535, "uuid": "7090e6a2-687f-4f4d-82bc-ac3f86dec3c5", "comment": "Malware payload (CoinMiner)", "value": "09b50ade1ce831a1f713ae36e9eefa7c0c40aba8", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748535, "uuid": "28bb1ae6-702e-4a0d-8440-66fcfee027a8", "comment": "Malware payload (CoinMiner)", "value": "734ea797b98b9bd14e4143acf987044f2230fa0faadf2a0e73d82df2904dcb37cca6eac28da2b331891146669034bb6a", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748535, "uuid": "1919d3f5-a374-4902-bfa0-aec5ae43de95", "value": "T1C215233BD56BB09EE0D318B22EC3606E3F9225D1EB1A495745ACF2F2573634BF919804", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748535, "uuid": "06fc0e55-cc21-4fad-93d3-7761d2bfa374", "value": "24576:U63vkAX6p4P2XW23rlSjSaJFT/a3HBLWMpQreRFRugN:vsDq2X1rEOa3+XFlpbRrN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689748535, "uuid": "6c0c3569-144d-4908-8c5e-807e3e439383", "value": 956336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689748535, "uuid": "1caaf847-f099-4e12-9f81-1aa0d62fffe5", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748535, "uuid": "2a5a00aa-c87f-483d-bb1a-56c2db9e17c0", "value": "dd4b52f33373c57093f1df396a76e058", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59cc54ae-25e6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689738177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689738177, "uuid": "bce6506f-a4af-4233-b63e-d91966526ec6", "comment": "Malware payload (Amadey)", "value": "0a0078e9aa75b182d33076182db21f09", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689738177, "uuid": "39d37700-6a21-4457-a536-e8529773e454", "comment": "Malware payload (Amadey)", "value": "1ccaf92b146c89c824046a4bf8a94ba1646e425ecf6432de085cc96358a7db9c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689738177, "uuid": "f4717256-5913-4bbe-b9a8-8d2a5ef388f8", "comment": "Malware payload (Amadey)", "value": "dc45a8085f53e9ceac803650b69f3858467db64e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689738177, "uuid": "7391f66d-0ba9-4ccf-af92-ab26147fb7dc", "comment": "Malware payload (Amadey)", "value": "d16e55a889b9095b7ec7a8cc746eee8f1e341b3a11ce90a62816722470d5b83d57e6808802f430bdaa9453115dfab3b5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689738177, "uuid": "49375bbd-a18a-4121-b47e-de2869d5b403", "value": "T14634D053E7D88072D9B5177058F703C31B36BCA1ADB8876B2B45A85E0CB3694A53273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689738177, "uuid": "426810c8-023a-4d23-af27-b44a2aa4bd18", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689738177, "uuid": "09eb43a8-177b-47dc-8fb1-f497af97b6b3", "value": "3072:KUy+bnr+O1Q5GWp1icKAArDZz4N9GhbkrNEk1ZcobU3btQutRCIuN75Xo4A+exoD:KUy+bnr+Dp0yN90QE3biPXx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689738177, "uuid": "2f0066c3-67ab-4717-b4cc-96eafd4bf78e", "value": 240128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689738177, "uuid": "8046a2df-7398-4a83-b78a-2e80a50d430e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689738177, "uuid": "c0dbb7f0-4a2e-4994-9726-3ac3a8a63e51", "value": "x3731075.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e226809-25fd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689748063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748063, "uuid": "f6d06600-431c-4a51-9684-0333c9492396", "comment": "Malware payload (AgentTesla)", "value": "6d126c9b203b8cab7cc44d77c75971e3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748063, "uuid": "f5ba08a9-5f5e-40f1-a610-5ff17a31b271", "comment": "Malware payload (AgentTesla)", "value": "1cd2d3a2f9c7aee2440fe8386481287fa8f66f39f6940bfbb4b5779d6b4d3bda", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748063, "uuid": "93eeb931-9365-4976-b9c4-c69c49cf9405", "comment": "Malware payload (AgentTesla)", "value": "45fbd8304300f10b955cbdb8f7c26b7c500cfda8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748063, "uuid": "703b4a0c-ddd2-464e-98e8-857d889dd50b", "comment": "Malware payload (AgentTesla)", "value": "b8df726403463efeea286bfe3f5df48f7df9811fdf644475626a2b474a0a7d0464cbff333569657e54cff9ebd1d2b9e5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748063, "uuid": "e823754e-7a05-4aa7-b1a6-dae2fb7358e2", "value": "T1F16412016729D8A6D8F08431766E063F8FFDEE2576A02D43CF848A4DFD16DA18B1B15A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748063, "uuid": "dff8b955-d567-4b5b-98cd-7d12928b0ca5", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748063, "uuid": "4529dabc-1783-479d-93fb-fe6b01240d85", "value": "6144:hVGdx6xKzuH+DfnFhEVj0UtAzwo4WNZJaGiUGCDHDKI61rhucyZURcmysbD:PjeDfYVoUttjWXJZiURDKIkrh3yZHmyG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689748063, "uuid": "40c7644a-18ba-46e7-99ad-f4a0e1510653", "value": 315992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689748063, "uuid": "17795d9d-dce5-4912-b92e-bffa6516cf33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748063, "uuid": "bd457165-969d-4e2c-bf27-34cb7fe9d76d", "value": "YEN\u0130 S\u0130PAR\u0130\u015e-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "397b4491-262c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1689768187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689768187, "uuid": "c0db6448-f020-456d-9ad5-9f2486748a33", "comment": "Malware payload (Formbook)", "value": "2f43d372b3a9011ece6307fb5d9d4c35", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689768187, "uuid": "f2c1be05-b561-401f-bf03-d0cb8d3c46ac", "comment": "Malware payload (Formbook)", "value": "1e355982ed461419460ecc7c0963264aef160c61cd4bc5ee42a15fa92fe1f4db", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689768187, "uuid": "12f1a082-e443-49ab-b3f0-d9190cd8eaf8", "comment": "Malware payload (Formbook)", "value": "26339538ebbf7ddb9268229c61babaa4e068827d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689768187, "uuid": "8f27fade-2812-499b-a653-f9084e044218", "comment": "Malware payload (Formbook)", "value": "d337eb68727f31faf2acd05a7bc3eb4e6e1ae1211c1f96b360c8cfec5710af2fceba49e171e7cc6adbc2f2ec04f023ed", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689768187, "uuid": "5d32ced5-d1cc-4496-9e10-95afe35749c7", "value": "T1AC44233925B6A8849AF2C769CDA88F1B8468F61C5DD074BDDE391CCD0EB935E8C3548C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689768187, "uuid": "25a67a5a-a18b-4207-a1e2-aa4638a4b4c1", "value": "6144:GLJsI6Sf8mwHGAWmjrLqbeQRemhrTUGqbEl6V99nSqusoGwtq8:GVuGAWISiY1htq4Ynjuso/J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689768187, "uuid": "39911cbc-3394-4ac7-80ee-fcd1146e19f4", "value": 268188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689768187, "uuid": "df9288ea-01f6-48e3-8623-74176654c6d2", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689768187, "uuid": "9929fcb8-2524-47cd-b0a6-521c4866a925", "value": "HBL.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec37977f-2665-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689792969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689792969, "uuid": "5a92d710-7dc1-48bc-a03b-d84b8e282c96", "comment": "Malware payload (Amadey)", "value": "4b1795960e7d4aa085834c9a2670aae3", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689792969, "uuid": "3675d213-f86a-49e0-b873-512fdf6b8710", "comment": "Malware payload (Amadey)", "value": "1e756c3dd2f7e40b65e81817bfdb8988cb9c718ec0f522915ca3dcd647e2f017", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689792969, "uuid": "4790e8e7-23fc-4e97-b3f9-991a20de2c02", "comment": "Malware payload (Amadey)", "value": "4cccc41189287ac70bdd813b9c65d539b98a22f4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689792969, "uuid": "976b6b26-3999-4a5b-a196-229ac2539853", "comment": "Malware payload (Amadey)", "value": "d53282099beca1ccf144266e87cdfb21fbcec9a61a45ecee9c23b1f5d532efeae1afa55abf74be1b2044e457c2636d69", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689792969, "uuid": "3564195f-22d4-4ee7-bf70-a6de44660da8", "value": "T169840217BAED8473DCB12B706CF603930B36BDE16D75836B2645984A0CB3680A93577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689792969, "uuid": "542b8cf0-e591-4e27-b2d4-0b3b9cdc1692", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689792969, "uuid": "1b815f58-7b6b-482f-bd50-4ea9618342f4", "value": "12288:gMrIy90VK1uWtbK9LuUnVQR5Nj9zx3If:4y4ktSLFVQjvu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689792969, "uuid": "9caf0387-9f41-4ef1-a4df-416e5e2a9434", "value": 398336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689792969, "uuid": "781658a1-9bdf-446d-a092-b2d3e4e0269e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689792969, "uuid": "9e9c0b0a-9752-41ad-9009-105b68056132", "value": "4b1795960e7d4aa085834c9a2670aae3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e95806b-2630-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689769834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689769834, "uuid": "fd671e95-e86b-4e4e-adc1-c7368733565e", "comment": "Malware payload (Amadey)", "value": "1942d1d3d93833f0a1d4f5381ce33a23", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689769834, "uuid": "9707de46-d6a4-4c4d-a7cf-f0a40aa111bd", "comment": "Malware payload (Amadey)", "value": "1ed736973ca7eb70129cafb36c292298f34a8a710160e69aeec7ad93760ed83e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689769834, "uuid": "8aa5fa50-6c9a-4656-aafe-f82e9363b3c9", "comment": "Malware payload (Amadey)", "value": "4056636db4625bb6b3fee03b4c1be992681affa9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689769834, "uuid": "b8e37ae8-eac8-4af2-8b6e-85dd25ef9743", "comment": "Malware payload (Amadey)", "value": "e9263d01a46825666c6433ea386f02364d112b9a18b990348bfe8b355d394a8927ae745544271aff0244c871e47c8325", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689769834, "uuid": "3f3d4d90-9378-4726-9db4-b3fd009d8ba4", "value": "T13BB41252B7D84432E8351BB058FB47D31A36BCA5A928C76B2357A90E0DB17D0B93173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689769834, "uuid": "5dd3f8d0-86d9-4e07-842b-2d8b40db07f9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689769834, "uuid": "49a1b199-54a6-4241-9841-e32936ed4e13", "value": "12288:SMrqy908fsn+JqW9WsGJPMj1kn4tBA6jmcRyqBq08:4yIEqwWsKmy4YikWJ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689769834, "uuid": "745d1475-29f6-4eca-8172-847b8c9e6fc3", "value": 526848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689769834, "uuid": "849a4865-30f8-4880-bbb3-eb53209aa7ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689769834, "uuid": "a427c6af-b2e4-47f2-b674-88a3887aeaf9", "value": "1ed736973ca7eb70129cafb36c292298f34a8a710160e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e195cd1-2617-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689759149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689759149, "uuid": "4eddacd7-413d-4b5e-8471-71d5081672a8", "comment": "Malware payload (AgentTesla)", "value": "c5c9a087e173d9147dcef44e245cb3a6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689759149, "uuid": "6c3832bc-085b-4c8f-b276-60e9ceabc1da", "comment": "Malware payload (AgentTesla)", "value": "1f3b14db1c68b55adea5ba2f81004c64c0de2880024dba370023341a2ea31844", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689759149, "uuid": "357348ec-ab86-43cb-a18d-328c5face530", "comment": "Malware payload (AgentTesla)", "value": "87b472299385cab058afa9b4edbfead6793d18d1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689759149, "uuid": "b044b543-ba34-42a4-9a13-a609ccea1065", "comment": "Malware payload (AgentTesla)", "value": "328c3841b00a37dfc4154526385a52a777ea9c7b7f3f98b8ac3406ecad71761da1622dbb2728b9bbdf57b670dbfe87a6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689759149, "uuid": "31e7f88f-5e75-49ee-8b5e-2fb3a22f09ab", "value": "T175C4235EC673102877793D133889B8F5FCC82E4BA1858414F6BA75A5D37B6ED3823A81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689759149, "uuid": "756bfce0-442b-4ade-b7f6-00a1e20094e9", "value": "12288:Z8ykJEWNgIfERzsHQUtcrRC2LjpoMh1oc6Oh1/xAzxQDCMJM:Z8KWNgTR4HQUtmtjpoml6wWWDlJM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689759149, "uuid": "f0977585-0cb9-4c73-a653-075d87397dbb", "value": 586005, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689759149, "uuid": "3c8266eb-b4a4-4141-8cff-ef33a7bfeea6", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689759149, "uuid": "d6a0d4ff-36cc-4268-81f1-7cc19eb2fa87", "value": "Oferta.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67fbea6f-25e6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689738201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689738201, "uuid": "39653e9a-d452-4ec5-83c4-35fe4b3e7108", "comment": "Malware payload (RedLineStealer)", "value": "2cde27ff17dbea2a29e2bc9935382912", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689738201, "uuid": "852072ab-d2f0-4796-8258-ebba4c439104", "comment": "Malware payload (RedLineStealer)", "value": "1f7c5491ca4e4daf5ef15949b151b3606406ac9c23c264b6d97c16881ad2d725", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689738201, "uuid": "46f37f18-6ba8-4023-968b-5314a69af535", "comment": "Malware payload (RedLineStealer)", "value": "d1bf0c40f30d177cc5c9a53340cd19608a448a36", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689738201, "uuid": "4f11e68d-04c0-4957-aa73-7e5d31bf079a", "comment": "Malware payload (RedLineStealer)", "value": "bff4afc6ab7ac96ddc7ed4947dcd4a27b0d4058b555a857f023ac3ac7f85bb7751a1e81a5e7e0c5e565042232494c120", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689738201, "uuid": "09f1baf7-3183-449b-9ff1-bb22df0fd952", "value": "T1EF04D558324BA57ECA7F883D9C700CE0677CAC665246AB078D8EF4E43D3A7919E051F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689738201, "uuid": "1e44e5fc-2bf8-487c-be7a-73e041a18ca5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689738201, "uuid": "e59ae1f4-4a1b-4ccf-b825-376b8f6f1971", "value": "3072:cMC/Huw6uatUGpExN8aOqcJ9Fw/8e8h9:cK1Uef9DFw/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689738201, "uuid": "77accaff-4028-431c-af18-72815751bee4", "value": 179821, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689738201, "uuid": "c1d044e3-c246-4b17-af5f-c72017a8653e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689738201, "uuid": "5da3b0f7-1975-488f-8888-79a9af4f01b0", "value": "n5881357.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86310ea9-25e5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689737822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689737822, "uuid": "3edddfbe-a321-453d-847c-1fcbb0831891", "comment": "Malware payload (RedLineStealer)", "value": "e9aa8c152dc8877d948caffd28fb044b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689737822, "uuid": "406e399c-691a-4d7b-8dcc-2a8b7f599123", "comment": "Malware payload (RedLineStealer)", "value": "2032f9f40f981b02935c84b405c361944fd04223bd1ec1a607653de7fde703a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689737822, "uuid": "f09a0c74-a09a-4bb3-8a51-9576525b8260", "comment": "Malware payload (RedLineStealer)", "value": "3d2d5ff3bbd92c90a5a49b0ae85d6805f28cee1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689737822, "uuid": "b4796d1f-0a16-4fdd-b0ed-96a1a7e408a7", "comment": "Malware payload (RedLineStealer)", "value": "4cb8f63f09af73e268cdffeea70d61e40d9c4375cc2134d808c394f808ffa008b6a4528d228a80dd2599375bbb46a5b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689737822, "uuid": "11822ac2-dc18-4fa4-9c05-f91f40531935", "value": "T145B412176BDC9033DDB417705DFB02C30B36BCA29D68A27F5786A89A1C72184A97173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689737822, "uuid": "b66194b2-f62f-44af-8e5b-46b645ae6a29", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689737822, "uuid": "91438644-0274-4fb2-a7f3-6e620991d3aa", "value": "12288:oMrQy90DVGJm+fqVKCXhhKYcmZAjl8QqVYBbD4y:oyAVgfxshimCh80BF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689737822, "uuid": "a467286f-c316-4ede-8788-9faa1917b51b", "value": 527360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689737822, "uuid": "ffa7523a-757a-4f2d-b4bf-d1ce82676bdd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689737822, "uuid": "d942f227-0316-4ac8-9f40-a41540a9aa5f", "value": "eBrdZX0WZG7n0yRhbAOpZsw5.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89466153-266a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689794950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689794950, "uuid": "932d6143-ca34-43a6-b6ec-c32cf515c7c2", "comment": "Malware payload", "value": "9ac76a3ab763f2582fb408edce6edb51", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689794950, "uuid": "36e5c69b-df41-4785-ae98-6d64090f48f5", "comment": "Malware payload", "value": "205b16fb503856c22a47de9919147f75eca374fa0c0b9a63e734483e71bb4a47", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689794950, "uuid": "fc8e4715-72c7-43fc-8f1b-306c98388ceb", "comment": "Malware payload", "value": "6a37f737c297db30c52e7878ade1b72d1f5f8c24", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689794950, "uuid": "3fc64726-a41a-4273-b1ec-01209e21ff62", "comment": "Malware payload", "value": "933c81532a0cc1d5acce4738a6adf0ed39bba28b1741f63979419c97fbd8c6409f4c84ec89690b1cc97af881fd1526a7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689794950, "uuid": "03ceb97c-9fc1-4107-a69f-b5c95fe185e7", "value": "T1B774F01236D1C072D16B5D300970C6B12A3ABCB1ABB541DB37D82B3E6E713D15ABA397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689794950, "uuid": "94a4fa24-9104-48a9-8bbe-59898bbf2a4c", "value": "c00325e681dfc3d8c781e42e0892ceb2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689794950, "uuid": "13fd271a-46e9-4a79-8971-65e9111a28e6", "value": "6144:YM/Qm7WpvtSObYvZ90uzs+lV2kQ4EphhdEqG24fT9:8m7WrKBbs+H1Q4Ebo/2u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689794950, "uuid": "539a666d-0725-4dd2-9c32-93fddfbb13f9", "value": 353792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689794950, "uuid": "b0799838-eccd-4d1a-9d1a-31403637ce87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689794950, "uuid": "7b06c9a4-52d8-4d8a-b18a-578f5bf2ead4", "value": "9ac76a3ab763f2582fb408edce6edb51", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "366f26ff-25e5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689737688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689737688, "uuid": "518c2030-5cad-4bfa-ae56-fdfe13694d61", "comment": "Malware payload (RedLineStealer)", "value": "fed6eb48357bc9a5c4318acb5e78a022", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689737688, "uuid": "9aa9670a-2e0f-4715-bfdd-d5334a6304dc", "comment": "Malware payload (RedLineStealer)", "value": "2092fa1e17bc309f433f4b0353195601b4e13d635cb4dac8cac8a24e534e9e6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689737688, "uuid": "40b7a28c-cb5d-4ce1-b2a1-a11e5f6a6010", "comment": "Malware payload (RedLineStealer)", "value": "04d1a016cbb7b233fb96be2c2c6e08350b490a04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689737688, "uuid": "26632ca2-c406-40f4-a8ae-8e5637e1d0f2", "comment": "Malware payload (RedLineStealer)", "value": "67fecd92471f0b4040e3d38956507b9cb17c6fff434b55497f45a01690a609001429d6169c4ba6dc203fa25aafc49046", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689737688, "uuid": "9267bacf-ce29-4ec9-b29b-6c9dacd4643e", "value": "T1D1840212B6D99073D9B8177058FA13831F367CA2EDB4837B2381694A4DB36C4A53277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689737688, "uuid": "4b3ae710-80cb-4782-bf37-4a0a1be9b9e7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689737688, "uuid": "e06b7fcb-2772-4e99-bf25-a0ac2c360c7a", "value": "6144:KUy+bnr+Qp0yN90QEkopoRzJ8X9UKWZfHoSv0dGwCcHnlRHACtulSxii6o:8Mrgy901U8X2KWtvhcHnl9Du5o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689737688, "uuid": "941a7207-ff13-403a-af48-17b9d7eaa313", "value": 399872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689737688, "uuid": "23803379-5efd-498f-ac43-a02aab66ee2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689737688, "uuid": "20f0f47c-347e-4914-8b83-3785cf7e8046", "value": "B432.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8849b8d6-25f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689745556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689745556, "uuid": "aada90f1-c42b-4ad9-b3ea-ae2fd68f1126", "comment": "Malware payload (AgentTesla)", "value": "2bb1ffa8b176e243fde59e98998578bd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689745556, "uuid": "ba2de2ae-65e8-4c54-8c87-da660d91e9bd", "comment": "Malware payload (AgentTesla)", "value": "20951ff7514d86ca63b5560cb127f2da1bacefe032c8c839f1aaea354478b821", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689745556, "uuid": "9ccb67a6-ebab-45cc-a72f-519f26a3b0a6", "comment": "Malware payload (AgentTesla)", "value": "cce1eb5c2318a32114b4d44cd3e35a476a26734f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689745556, "uuid": "c2dd77e4-bbf0-4e2d-8058-9e200425bafd", "comment": "Malware payload (AgentTesla)", "value": "a0e9c480c9d2e3297bac2933896813c9f1bc176810c8babac89c918b6e6358e2bd1358d53518a29b66057b2bdd1ecee7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689745556, "uuid": "5b3a0cdc-047b-470e-8f4f-7c6440e57fb1", "value": "T1B5D41244B7E88617D0AD0BFC6361970493F8AEC66562E60A2FC3BCE6747BB405A50F53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689745556, "uuid": "86ee6d85-e5fe-4a8a-9f59-dec9bf6b839b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689745556, "uuid": "94696854-1464-43b5-aaa6-a261014fb97b", "value": "12288:sPYPfY7FpMnD9FUFnTUtG08/wq+DIT8b8e75m:sPYPg0ipYtGDIRDB8k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689745556, "uuid": "76c9cb03-833f-4a92-920e-3e822001c819", "value": 648192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689745556, "uuid": "98c321a3-ee58-4f96-80be-664cd2334b13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689745556, "uuid": "dfad403d-1f6b-477c-8633-712024fb695f", "value": "DHL Receipt_AWB#27040829822.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0be8eee-2665-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689792976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689792976, "uuid": "0f5ab696-a096-4df0-830f-1e106f955b8a", "comment": "Malware payload (Amadey)", "value": "febd8ad0b58c5bba814b411da22f5d54", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689792976, "uuid": "c0ab8dd6-1028-4e56-ae6a-2a537731c827", "comment": "Malware payload (Amadey)", "value": "2105dcf02a361a6e044ae4fd9ba45313396f787b2f29fe9b2d808e0eb6a375ea", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689792976, "uuid": "b8a0cab2-4360-4a17-a0a2-4f0046818c28", "comment": "Malware payload (Amadey)", "value": "c3e1755a4a540e0ad69f329c37c7f663e4aa56ca", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689792976, "uuid": "e9f4240a-1dad-4d2e-b1aa-def2793e03b2", "comment": "Malware payload (Amadey)", "value": "1ce9173ffd8081231932119631b8c6c365a11e39cf6643cef50b3117b03f08ba2c961da2dbfd6ac3aa21a243f2fe9a9a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689792976, "uuid": "5b39cb49-d505-4537-8c34-4fa0b15ab31a", "value": "T194840156E7E89523E8B127705CF703870B36BEE258B4836B2B46694F0CB29D4647173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689792976, "uuid": "bc1216e7-fee8-4d76-8af0-de06dda4a605", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689792976, "uuid": "b17331df-a9fe-4838-8f78-20286724d890", "value": "12288:sMrry90cxU+rWYTOE8dfrmGHdhpDdTtyhyMb6jgWmi:Hy7lWU+pDJbQgg2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689792976, "uuid": "24c2b171-07a2-49f8-94d0-14a50ff73906", "value": 398336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689792976, "uuid": "b4bfd99a-6a16-4c23-8a94-11bc3924aa70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689792976, "uuid": "2702c249-b617-419f-afe2-36bb5fd66264", "value": "febd8ad0b58c5bba814b411da22f5d54.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cae424a-2614-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689757912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689757912, "uuid": "c8553b98-9fec-4d16-8974-ad20a783fa64", "comment": "Malware payload (AgentTesla)", "value": "d469f817f6a85563eac8f58b2523c16a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689757912, "uuid": "9c99f88d-9387-4e89-b91a-1cf248d1a6b7", "comment": "Malware payload (AgentTesla)", "value": "21120d3d345131483b786c6149e39991c77c1308a088c2c4001187101b903dc5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689757912, "uuid": "9f6b3780-116e-4fc6-bf7a-96b8dc66ccec", "comment": "Malware payload (AgentTesla)", "value": "df59dda4e4bfd7029bd7f906293a83aa250aea44", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689757912, "uuid": "1cb60124-f892-4ffa-9c3d-98ba233b578d", "comment": "Malware payload (AgentTesla)", "value": "4ff6269a620b4500f11090476e60654cdde137d9b18dcce2d89f34a8ea9f67d602c07da1ae1ed05eab1d9c2391318017", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689757912, "uuid": "4b0a0e9c-9934-4229-88fd-da1b803d915e", "value": "T158350607399C59B3DA39833E402C1DD896F99D0C019EF529223CAABEE1FD5095D1FA1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689757912, "uuid": "ba3e0105-f46a-4b0c-9b70-42cd1e221dcd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689757912, "uuid": "5069477a-b653-40f6-9d87-d2fde0de8a59", "value": "12288:kL5pNTEifUw8dsIMqgkQNRNSOXET+WmAGQIut7DVVGG5JKT5b4jbtF:Y5z3fz8wqgkQNRTXtrAz7yx4VF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689757912, "uuid": "8d59d14b-6193-46a8-80a7-4a80e3e57f18", "value": 1124352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689757912, "uuid": "34a4dc02-c0b8-46a9-9626-91bf0d662445", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689757912, "uuid": "eccf8229-f1ac-49fd-9e55-e5a02c3a90d1", "value": "23JS0412-Power Shades wire payment.jpg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b26584bc-25e5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689737896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689737896, "uuid": "73e7a276-148e-4a37-a4bc-de7762a23894", "comment": "Malware payload", "value": "cea0993c190d91e53d07044499b341c9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689737896, "uuid": "18c1d8ac-9a8b-4fe3-99fd-5c5be78ee148", "comment": "Malware payload", "value": "2238e3327b261ba6d7fcf473b15edec80573fe8d0c40dcb84e944b4e2d5c2963", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689737896, "uuid": "fe713445-235b-484a-8695-3759f0187c83", "comment": "Malware payload", "value": "f48287a2441e2167879c2c53f3f2f5dede687e6f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689737896, "uuid": "1758dd57-3fa7-42eb-a45d-f69ed6d5f157", "comment": "Malware payload", "value": "96ae84bfa6310003e4fb3b97171f697a326950ec71e203b75a9440e6346413cd233f381749c0cc5f430bf1761c288b0f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689737896, "uuid": "21507c0e-c238-4f31-93a4-9fe49f77cddd", "value": "T18E337C457690C073D6AB063928AD96220B7FBD635BF894933FA9020D4EB16D07B3D357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689737896, "uuid": "f168d2e4-9e73-4642-a627-aa2bb12496df", "value": "48870ce7a0967218f26445c839c51332", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689737896, "uuid": "d5d2c232-53e5-4878-9446-7c2404a3b41b", "value": "768:PMeGbaAj/YhKMsN0bYfjEruWV2NKMKstyxdj2TtB7+HZxq9eh:PVG8zA9VKD72TtB6HDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689737896, "uuid": "6bb0d9a4-05ba-4a69-95ff-a0bb044c7952", "value": 52736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689737896, "uuid": "7baa1233-0a48-446c-a18a-ee9a32be4df5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689737896, "uuid": "f9a134d7-99e0-418a-8f68-7bcd1a2bdddd", "value": "SecuriteInfo.com.Win32.PWSX-gen.32031.23230", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2fb69e8-260c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689754701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689754701, "uuid": "4812bed9-1d74-4806-af70-dee3797eb7f7", "comment": "Malware payload", "value": "38943b6c004f2d4cea2ff85fb04b68fa", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "bat fixed", "colour": "#41BBA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689754701, "uuid": "b097d1df-34b4-4c8d-9df3-01423be4063a", "comment": "Malware payload", "value": "226f4cc20ac9e3f23283df70d913150d60ba7f54dca35133c72d34096bcc3c90", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "bat fixed", "colour": "#41BBA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689754701, "uuid": "d0d52907-7ba2-4dcf-b634-eda85e5bdf56", "comment": "Malware payload", "value": "931b56c52d41852711955a494fb61431e06c765d", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "bat fixed", "colour": "#41BBA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689754701, "uuid": "2419ba4a-f9bd-4356-805e-66729f831468", "comment": "Malware payload", "value": "93386e71402df7c5479595d0dbf96f2ee2ed5b20e10c31d5ad69624a5751444c73e7400b385215c4b179511863767449", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "bat fixed", "colour": "#41BBA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689754701, "uuid": "530d1c4e-69d2-4fb8-a909-e96241b10a41", "value": "T1F9C4233A4EB92B3A004DFB08B86D5DA7753497E5F42FA2E0C615FA087652EC4D3435E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689754701, "uuid": "3c6651db-6f74-45e2-bba8-95ce6ea3e7b7", "value": "12288:L3cmEtMjzZCLemNZJZ8d+k6Dz6pLJ61ecN:bp0mzwLdZJy4vDGzsecN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689754701, "uuid": "526099d8-4a22-470e-aa5a-b52dbb9eea50", "value": 597224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689754701, "uuid": "a02d3f81-4abd-4a7a-9ffe-0fd58a69d8e6", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689754701, "uuid": "567ab620-70ac-4b7d-aadb-c936274a6087", "value": "d.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "949631b2-2612-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689757173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689757173, "uuid": "f90b10d3-2527-46e0-88d9-1cb24d2cca87", "comment": "Malware payload (AgentTesla)", "value": "d024ffee3da567ee0d517c705b47cde4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689757173, "uuid": "01570df1-848e-4661-b653-d3cc2c781893", "comment": "Malware payload (AgentTesla)", "value": "2291b531418ae722b75139ceea563610cbff478c88358e368536bb249132a4c1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689757173, "uuid": "a25e1855-0797-457b-9584-45a3bdffa57c", "comment": "Malware payload (AgentTesla)", "value": "6ba0bce3949c9dfb18439f932fa53f107da8b90a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689757173, "uuid": "1dfe40d3-40b7-411f-a66a-cdc8aea69a4e", "comment": "Malware payload (AgentTesla)", "value": "ad063fa8c7a3feb3f23779f28b199eb174a4e6b3d168adcbe6445dc10b7bdca766fb67fa058b3a932c1f406ec6eb99f5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689757173, "uuid": "844a9c32-20bb-4941-839d-04e446735ee3", "value": "T185D4021069B48B23C574CBF91325A70053BA9FD82464F52D9EFBFCD6B2A9F150940E2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689757173, "uuid": "31e3f01e-f9d0-4386-a69f-8d9c7912b989", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689757173, "uuid": "0fd1b828-780c-43c1-ae9c-446d283db993", "value": "12288:SpPYPfY73wX5CnwqXPudSH4X7XBwN95MvUh3BcCg8XEB:ePYPgDwUwqXPuMe7Xy5cmxJgMEB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689757173, "uuid": "e42d42bf-d4c0-4726-935c-bfa8b96f31bc", "value": 646144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689757173, "uuid": "f9fe1fb3-0e4a-4f57-adc1-18965e536889", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689757173, "uuid": "419789f2-81ac-4122-8041-7d40db3630b4", "value": "Order #60-2309584.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4de7fc68-2659-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689787549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787549, "uuid": "a09cb90c-997c-4bbb-9681-2fa8472df3dd", "comment": "Malware payload (Amadey)", "value": "45bdb63c450034716e897d6462e4aca4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787549, "uuid": "bd6081f0-81ed-4811-875c-2473021a8304", "comment": "Malware payload (Amadey)", "value": "23bea5b85d6bafc9a62fa8bb8337d9c39b8f4f7d139c32113e8eaa6099afc933", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787549, "uuid": "ac32dfad-46b9-4a4b-9fda-a4f98b2a7ee8", "comment": "Malware payload (Amadey)", "value": "b9d7b109fb3194c76aae8de0007302ecad459efd", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787549, "uuid": "965d7387-4b4c-4410-afc4-f3277ec551ce", "comment": "Malware payload (Amadey)", "value": "cd85b72de8bdac29d58d78020ce36123b8394c0804aed7066bf8c1444d8dfd69cd20233a35531402e3c3e81bb84f8210", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787549, "uuid": "847acd71-766c-4643-a516-82c64fe7bc79", "value": "T16B840203F6E89033D8B427705DFA03D31B397CA1AD75926B2786995A0DB3980E53277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787549, "uuid": "eb9a59da-ed9a-43ce-988a-333cd6b282d9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787549, "uuid": "a01b5fd8-9ebe-46c3-a97d-baddb17cabbe", "value": "6144:KJy+bnr+hp0yN90QEE1e9lALt0B0MQkxItHdxhbheeNGtCcHnlRHmaGcUkSYfP:DMrNy90P9laWKfks9xvVNVcHnl92Y3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689787549, "uuid": "db52626c-97e4-473f-a84b-13608ddcb8ac", "value": 399872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689787549, "uuid": "62bb1cda-6209-4d2e-bee1-bdd8926bc609", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787549, "uuid": "3ab66b70-3432-4840-82dc-7c9a9f407591", "value": "45bdb63c450034716e897d6462e4aca4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b473658f-260a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1689753791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689753791, "uuid": "c7cc53e2-367e-44ab-8825-64a79ec1df1e", "comment": "Malware payload (GuLoader)", "value": "c56565bdd6b731c91f18f97ebe3950a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689753791, "uuid": "5dfe7a2c-2d06-4505-8bd9-b21f6ec95150", "comment": "Malware payload (GuLoader)", "value": "23ce36201afc4312d9e6057eaeb99898c8d78146bebe00374a66bcaa34e003ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689753791, "uuid": "16cfc6c2-63e0-41bb-87bc-6dac378f209a", "comment": "Malware payload (GuLoader)", "value": "7bf5711e4640e95edc3c8306c010eccd271d3d31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689753791, "uuid": "d431aa64-7008-4472-a466-7f178bc68bf5", "comment": "Malware payload (GuLoader)", "value": "700a3f1632b112ca8b66c562680e2e5a4801cbd2fa63a67bb50b3f575c2166c01511ee589017baad7fb7437fcc8d9a01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689753791, "uuid": "2d47ce8d-d3c2-42e9-a343-67c44fc71420", "value": "T1DBB412116A88D522C8621FF14D63B8AACAE98C54ED72AF0F535A386D77713D32C0D727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689753791, "uuid": "2c009e35-32eb-47e2-8738-cb9f2e73029a", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689753791, "uuid": "adb500d1-3206-465a-9850-4a637ec822a0", "value": "6144:apSOBQ5PN5chpHAkk7u6+cXYTGh0zZiQb4GYX2jN7tRfmHy70dDi0Vgtu5uQcDB7:CQIPQTvYjFM27dgi0Vg0cmFcWI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689753791, "uuid": "8114f2a6-d368-41ed-ac37-a27df0a17ce8", "value": 507876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689753791, "uuid": "4e82134f-26aa-490d-909b-77b553624616", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689753791, "uuid": "7c5dcbd7-e693-41d8-88ab-30c4038079f9", "value": "W455-02 UA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "073b24fb-265a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689787860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787860, "uuid": "55e5b35a-12a3-4f8b-aa0b-9cfb21beb4d3", "comment": "Malware payload (RedLineStealer)", "value": "ad9be100cf69828b8e7a7a836154d5e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787860, "uuid": "688b3675-6cab-4169-afa0-139264ea85b4", "comment": "Malware payload (RedLineStealer)", "value": "24b96bca469764debd638550bc2704add4701110cc7a691fae627e361d8188df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787860, "uuid": "38f15299-8cb1-4034-bf02-15eea064d4f4", "comment": "Malware payload (RedLineStealer)", "value": "dbf0f2accdb22e674419d2c0abda7fbef534c3dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787860, "uuid": "8411afa1-5cd3-48f5-b9a5-655a57b09576", "comment": "Malware payload (RedLineStealer)", "value": "8185de296a9191ff97ea44b780522e2a622f7db4b90eda8e6d3c4e1d650f02d848b3e0ae84ee99ef69e37ad6520faec1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787860, "uuid": "ad195bc5-ac67-4c76-ad0b-79362201e7c7", "value": "T17F840112A6D88433E8F527B059F602831B35BCB26D79936F3395988E0CB26D0B57537B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787860, "uuid": "3bff5864-e0a6-41b4-bdf9-cb9a1bb983f3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787860, "uuid": "39460990-f918-4926-94ba-05dcc491e9f3", "value": "6144:KKy+bnr+Rp0yN90QEnI11PokWcnZNbQR5nfyQPLaW5F/tyKYuNcUNQfMFkkhgVRn:WMrdy90uTPTcty+dqMS/VRi1nm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689787860, "uuid": "386fb48f-7cb6-4e4e-8bb3-db09414ed289", "value": 398336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689787860, "uuid": "0e98d350-aea3-47f7-a241-a9bde1ccf87f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787860, "uuid": "5a07f311-36ea-4ec5-aa80-54bac09b17f2", "value": "ad9be100cf69828b8e7a7a836154d5e4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bbb5987-2686-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689807007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689807007, "uuid": "a3bf3570-a78b-4b64-aa24-b76abf0fede7", "comment": "Malware payload", "value": "fa0f9935ea2520759c2e21a3dd542916", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689807007, "uuid": "121645a4-a45f-4630-b533-37797a345bf9", "comment": "Malware payload", "value": "25223dcb5c58948525d07a527f3d60b9ac1d5066f158ca0dd9cfcdde0570f9ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689807007, "uuid": "ff32f046-7b45-4fb2-bdb4-497f05183c71", "comment": "Malware payload", "value": "b70cf211c64be70f212670547a573dd57148b7a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689807007, "uuid": "75f3bd51-5547-45c7-b7d6-a11ad6bc261b", "comment": "Malware payload", "value": "c58bacedfe67b3c1bf7dd4d897e7d6fe29a8a802ef1ddf29bcb0b52e8fb48bf52e611f6652647e0ed5bced7c10f01e7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689807007, "uuid": "a39cc998-f198-43f1-8d90-1fd6b4698174", "value": "T19C74E11136A0C072D437A7311531DAA12E7ABCB2ABA151DB37143A7E5EB02C14B797BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689807007, "uuid": "795926b7-8b08-4b36-9bbb-f6c39d8e8bd3", "value": "02f23a44e70611470e4c2107da6d7f64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689807007, "uuid": "c696ef10-6fe3-42ee-8fdf-2d9e1747a391", "value": "6144:GFPQwsbnBILu67a4aV1EEso2lI5vaZwJX5b:/wsNw5+xnshI5t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689807007, "uuid": "23d60178-84d2-4de7-8042-f682e9553af6", "value": 360960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689807007, "uuid": "db6fc7e8-7637-41a6-ba52-1e84d21740bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689807007, "uuid": "3fb9dea4-e19b-43c1-be83-9c9ada20d556", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bf7e326-2666-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689793264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689793264, "uuid": "4a83321f-a692-4fc9-8804-263d07155a5a", "comment": "Malware payload (RedLineStealer)", "value": "3771b4c96e795be987902e8570812818", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689793264, "uuid": "48932653-fcee-4152-95d8-f7d7150f0f74", "comment": "Malware payload (RedLineStealer)", "value": "252fd9780d4463383da979afb189fa8d5801db53ccbd9348103d8941dd6f73e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689793264, "uuid": "9b023994-630f-4460-b41d-ff117a4d354b", "comment": "Malware payload (RedLineStealer)", "value": "c60306a6cb69a2d25c49ae5d4f792b8904682972", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689793264, "uuid": "cc02ebc0-8161-4b5e-8b93-438d6ec7e879", "comment": "Malware payload (RedLineStealer)", "value": "09780fe42ecbccefa79cea06d778f53b58bc5787223dd3778875ee0462caf782f47a29d50b13433c3eef530529e42215", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689793264, "uuid": "d0f8db06-ad4d-404a-8873-8fb672053594", "value": "T19A840153B7E84432D8B517B049FB02831B37BDA26DB1837B27D1599B0D72694A83237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689793264, "uuid": "bf0c05b7-8406-48c7-b805-682fb0cabe82", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689793264, "uuid": "b98a577f-4cc9-4234-add1-af5a46e032d4", "value": "6144:KKy+bnr+zp0yN90QED3avXessYt8VDBENNDJnFjmCcHnlRHVoeWwPy5XMKPf+0Bb:GMrLy90oX9RntFTcHnl9HWqy5XLf+M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689793264, "uuid": "042454e3-d0a2-4c9e-b71c-8b94f94b8f34", "value": 399872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689793264, "uuid": "a2f0652f-b37f-4958-9c84-17e25a210bec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689793264, "uuid": "3e44af20-3c25-4931-b52e-d8f7be43ee1d", "value": "252fd9780d4463383da979afb189fa8d5801db53ccbd9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf775c7f-264d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689782586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689782586, "uuid": "083a209d-e1c9-4961-98c7-72965a4d350a", "comment": "Malware payload", "value": "41d620005f1317028d4fcc303345310b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ThirdEye", "colour": "#4F269A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689782586, "uuid": "e5aa682a-2899-4def-bdef-8fbd42deddd2", "comment": "Malware payload", "value": "263600712137c1465e0f28e1603b3e8feb9368a37503fa1c9edaaab245c63026", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ThirdEye", "colour": "#4F269A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689782586, "uuid": "205c63ba-d866-454c-9b36-28d733413f04", "comment": "Malware payload", "value": "43c4be21c214c6c95a683c34af1e500b80845ed9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ThirdEye", "colour": "#4F269A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689782586, "uuid": "e2bdba98-0047-454d-8796-f18d23900969", "comment": "Malware payload", "value": "9034e5fe937d09a109919d09502caa8c1b5b1878c964b10b1b68cd4687cc773e2e31639a3b17c5a157f08d3c0bd91a48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ThirdEye", "colour": "#4F269A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689782586, "uuid": "54ac784e-eb1d-49ac-b78d-6d3c7bdbda22", "value": "T10D748D1AF2E918F9E47B91788C524906E6B6BC060371CAEF13E046562F377E05D3EB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689782586, "uuid": "ab6a7b12-c100-49e7-b2c5-3ad610b64746", "value": "5bcbffd34e4a160f886e45d2b4c32b4e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689782586, "uuid": "05b196a1-fbbe-43d8-904f-0cdd22f2c96f", "value": "6144:gYgmJzkLmcO4Y4oJtl8alFX15Eo0wVS9mrohyfLeO:xuGQalp15lHS9Eo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689782586, "uuid": "1281a293-5510-443f-8797-0f9344902d1d", "value": 345600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689782586, "uuid": "344f975d-e6ac-49e6-bd0a-b757d0cb48e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689782586, "uuid": "7b17f746-147d-4fc7-9a61-e417c3a99a96", "value": "263600712137c1465e0f28e1603b3e8feb9368a37503fa1c9edaaab245c63026", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59d75a4f-25fd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689748055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748055, "uuid": "8224a88d-2e76-45f4-a07f-35498145ddb3", "comment": "Malware payload (AgentTesla)", "value": "13768662a1d416debe5fb47278885bc5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748055, "uuid": "2f0f1c64-f828-4f57-9bac-b552890d5168", "comment": "Malware payload (AgentTesla)", "value": "268cdd7d5a374b6f95c28d1411476cc86a92c10c0dd8d8eeeb973bd794aeee73", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748055, "uuid": "957c842f-918a-4c97-9cc6-411ac603dc48", "comment": "Malware payload (AgentTesla)", "value": "b084c99f59f7ccf455ba8e361ba2d54fa3a1d1b6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748055, "uuid": "b6f04135-897b-42ac-abf9-941114fe17be", "comment": "Malware payload (AgentTesla)", "value": "7ecaa9e2fe10e7a36dccdf2aef06c0e8ae061cf64edc5c1e860057b67536513718a3d89a370570e9a941a96686c25a2f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748055, "uuid": "bbf37f1b-c711-481d-a4ae-307226717f7a", "value": "T1A335494EF2C5D896D9123138D425C5F12BE1ACF9D245A45B20EC7F3738723D12CAB9AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748055, "uuid": "ca60bb4b-2bb4-49ba-8bd9-289dfe84b8bd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748055, "uuid": "ba772806-03c3-4644-9ed2-9804828c1119", "value": "24576:dJZdwVbFxEgUBaGHe/eXv7HTRhmwGhxVFUk+1pl:dFWbwDHeaTRh6W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689748055, "uuid": "34b9b791-358c-4c12-abb4-4aaa31cb5de7", "value": 1162384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689748055, "uuid": "a805b748-e2d5-4245-abab-7709bf42b140", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748055, "uuid": "b2dc72f2-a87d-4cf6-9838-b570c96025e6", "value": "DHL_Exxpress_Shipments_Confirmations_KBJ2023140498.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89b324a3-25fb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689747277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747277, "uuid": "db2f8e2c-1012-4945-a8cc-e9dc43128ad9", "comment": "Malware payload (AgentTesla)", "value": "5ec38f2ff5e6cd153e45879b4d276efe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747277, "uuid": "df14d8d0-586f-4fa8-b3d1-9785b9483b1c", "comment": "Malware payload (AgentTesla)", "value": "2768400847a861225f77e29ea61b399ab730571e068f3fa8a48072c94dc893e6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747277, "uuid": "4768f68f-46a6-4d00-8a7d-3a9b17272adf", "comment": "Malware payload (AgentTesla)", "value": "b4058f0399f891023c43963bfa04c0acf45ae68f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747277, "uuid": "43904d84-2d5f-4c7c-bf8b-62c2d4bc8767", "comment": "Malware payload (AgentTesla)", "value": "343bcdc10c1ed46d40886b503651a112b1d983a7a976a8c7ce5184e5d66dd74b8a03cd64ae8c24ed4fa817bfed1b7414", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747277, "uuid": "b9ed7bbe-7c93-4e30-9785-df22881e15e4", "value": "T1A8F4E01036685F13E4BD53FD9124621453FA6A57662FD3588EC33CEF39AAF504B01A2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747277, "uuid": "31a26820-2b1a-447a-92be-32acbd58351c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747277, "uuid": "29b2eaa5-a773-4e4f-ad3f-dd9a03c58185", "value": "12288:6f+mSkOpcW9Rohgfb/WT4UkuZfHBY7xsSKwN2cMNAnNiJCyeICFiEVsl+PJOzctk:6Gx/pcW9RohgfzW/Z9BwY7IAJ8Iiz4+U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689747277, "uuid": "b6430bab-5d74-44db-8fe0-bec9e54ce35f", "value": 750592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689747277, "uuid": "667f06aa-e9ac-4639-b59f-fd592f8f9431", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747277, "uuid": "0f5c29a4-b313-4055-b715-dee62d1a05a4", "value": "#GS5SFbF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "873ab1e5-25fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1689747702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747702, "uuid": "0c3d1031-1c48-4fbe-a6ee-db4b8be26715", "comment": "Malware payload (RemcosRAT)", "value": "3a5df6c647f584c3c9969e50ac866938", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747702, "uuid": "9c3b7ba6-07ec-4f3e-bc4c-87017e3f724e", "comment": "Malware payload (RemcosRAT)", "value": "2775c8d140ff4b9a0c55e57efe291b359935ded72b0eebdc86bb409921e34713", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747702, "uuid": "f56306fa-7a8a-416e-bf61-e3c8a8db8f9b", "comment": "Malware payload (RemcosRAT)", "value": "e0b66c7e440c3a14818798bee1a5cdcd941c9185", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747702, "uuid": "f73518b6-501e-4313-b2e2-0d1ebc46cbfb", "comment": "Malware payload (RemcosRAT)", "value": "4d89ed2cfd510ec33c3983c6b8d61e0de66b024e4ff08768d65e0ea17157189762e5834c5b7e3e427794d221a7f9ad5e", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747702, "uuid": "a65defad-450d-452f-b446-9774f29b7624", "value": "T15B15F28C57F0412ADB9E07B97878A30CD26DE49E2163938EC448BAAA3735774C9F1753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747702, "uuid": "d996a6ed-683a-43f8-9179-65087b8d8fd4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747702, "uuid": "88430838-e65d-4ef0-b2aa-24e157ca1c1e", "value": "24576:w0tGByBT/FzVEbaoTAGNdqHKZh6Qf8OGXAWfbHAL:3fhSa5GPt/8OEXcL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689747702, "uuid": "327a79e5-b306-4dce-a7e9-0a7bb04d8ebb", "value": 891392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689747702, "uuid": "2ce48519-afbc-4748-9b65-a02e2ad0e0b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747702, "uuid": "2cc2cf8d-01f6-4a4d-a946-4782b20c1107", "value": "DBS Bank_ Payment Advice_ Pdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70f0b646-25fd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689748094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748094, "uuid": "4912f858-d431-4d38-8010-1e8888760e6d", "comment": "Malware payload (AgentTesla)", "value": "1ac8ffa945f3b221e6b241e25adb3ad2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748094, "uuid": "3beadcc8-cc83-4eeb-878c-d9868db15fa5", "comment": "Malware payload (AgentTesla)", "value": "27c66e4fca745ecd962769fd00218d7a645f338a6e20b25cce8b88d784a89a0a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748094, "uuid": "1c6392cb-6f24-4913-a0fc-e444399c2da2", "comment": "Malware payload (AgentTesla)", "value": "ef101f78cc3b4cc3d184a6a0c0559240e403b711", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748094, "uuid": "a7729fa6-bc3d-41dd-b103-06a23ec35a37", "comment": "Malware payload (AgentTesla)", "value": "3edc764bab6d2b426923283fd97f1e2dd86c29ebb1fdf703a008af162b72be3033a0a0d053ffeec7cc7fb716c047cfb4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748094, "uuid": "d5dda7d9-a74b-421e-8bb4-22869d469de6", "value": "T100A4C9012EEF010861B7AA9B5BF914E85F77B9B2A439C55C644E1A0D0BEBDC4BD10F72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748094, "uuid": "32375f2b-ccb1-4df4-afb2-b587b7367b8c", "value": "6144:4n+vMxzakCYIqO+usl2tSc9RVZ0BPpPjD:BMxzakCYIqO+usl2tSc9RVZ0BPpPjD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689748094, "uuid": "8fa6f947-5a82-42f2-b42f-6d933d13deba", "value": 479894, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689748094, "uuid": "a0f84fce-c3f8-4a41-b8c1-4ad3d2f0a040", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748094, "uuid": "a8e5cdcd-0baf-4da8-8a0b-26e17fd7b22b", "value": "##..080933400cotizaci\u00f3n.pdf_.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6481c430-260c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689754516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689754516, "uuid": "56885c0e-ff25-4765-8161-dbab37905f1c", "comment": "Malware payload (AgentTesla)", "value": "68317f015fe6e324fe94626a717096ba", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689754516, "uuid": "a4c8ee10-882d-4f1e-940f-8e6be7aa75b9", "comment": "Malware payload (AgentTesla)", "value": "27e6ffdbf03abc3ce8fa3f8d8afb9deafcb4f6feb1b1ecbc56dd846e6b3bac37", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689754516, "uuid": "0ca45cb5-57f0-49d5-90fa-a016f1a7936b", "comment": "Malware payload (AgentTesla)", "value": "997855478fdc4cb5c0d106390f9b882af0b7efdf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689754516, "uuid": "e908a273-023f-4e96-bbf7-f04e2c915db5", "comment": "Malware payload (AgentTesla)", "value": "8f3b729ce013effcdf15346fe155727882d4ab255a20921f1b4cd387c5ed65c8bf9e39b1683e95568abcac3fc22c46b4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689754516, "uuid": "36c63da1-9bf1-414f-b691-7d3e27cde9fc", "value": "T10DE47C9F31B8C68BE65976E074224279C8EE942F60DEE7482B24E4D816D93ED1054FF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689754516, "uuid": "4b36c22d-af26-4c46-8c71-2be2aff807d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689754516, "uuid": "4af46f55-bf85-40af-b29c-9b2a2c493d1f", "value": "12288:eWmam5/yxKw3NMEA5hnmV2zwGWwlqMpwTnyQz9:eram49+5lmVJeEpjz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689754516, "uuid": "c9fa5f8d-8dd2-4e9f-995b-62ad5a45a66d", "value": 687616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689754516, "uuid": "455cd74a-026f-4bd8-b8e0-2bf264b08f5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689754516, "uuid": "51e8ceba-1e02-4c25-8908-dfb604f62edd", "value": "863037-Remittance Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfa8181d-25fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689747850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747850, "uuid": "223f87fb-4167-41cd-beb3-74f7b95c004d", "comment": "Malware payload", "value": "b63f38f2f3c85029224afa21136b6fca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747850, "uuid": "15b30c29-e2a9-404c-88cb-d766f75b03d4", "comment": "Malware payload", "value": "2861a4f8e40b9023bd9fc09eef5c2b83f55616d4ce5b82143518f96c9e684d68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747850, "uuid": "cf71a94a-b837-43cd-bb03-f34a7c3a3cb3", "comment": "Malware payload", "value": "6f83dcb60d2beb0c065d04c788c8fb9761591832", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747850, "uuid": "fe284cdc-e8e4-45ac-95d1-d19656a7595f", "comment": "Malware payload", "value": "df5aa87b9a7ac3ae636ba43e7da603cfd76dbc00a38253975f4889a5a9e77499c043d19cc2a31b06f2ef76a9c1e88742", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747850, "uuid": "064d9c9e-0799-4a1e-a7cb-cba1554e643f", "value": "T129852352FAC45AB1D97225311A39AB25AB3D7C705F22CDCF9340592ECD321C0AA3A776", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747850, "uuid": "b2b0e0cc-59c3-4b40-925b-2e6140e36be1", "value": "0ae9e38912ff6bd742a1b9e5c003576a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747850, "uuid": "cd5d517c-3e80-479b-8995-383ed94391af", "value": "49152:HdgOt/9uSR4t9q5uA15I3snxa+ZE3ZOz9nQ:HF/QyC9qwA15gsxRZEJOy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689747850, "uuid": "3020b024-56d7-44d4-881b-a0d6f9bdf3cc", "value": 1806650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689747850, "uuid": "d48dedf2-58d8-4c50-990e-8166358de0ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747850, "uuid": "41b4b95c-61af-4516-92c5-09646f7f244a", "value": "b63f38f2f3c85029224afa21136b6fca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff2e8c08-2659-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689787847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787847, "uuid": "560f8eef-1f21-404a-a62e-ee31146567d2", "comment": "Malware payload (RedLineStealer)", "value": "c81eeec11292ccaa7cdbb3db63822d6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787847, "uuid": "c59ddc73-b425-4cbc-af12-0ba62f9fb2a9", "comment": "Malware payload (RedLineStealer)", "value": "2888899f5101fd07b4c026a7ffc678de077e99180fa38380f1bef3df8e3e2371", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787847, "uuid": "02f13324-c9cc-48f3-a7a2-c02a2f86dfa3", "comment": "Malware payload (RedLineStealer)", "value": "f14329e6d9e5a6ea3fe099627fc4d21adf855e10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787847, "uuid": "fcfda5cf-adcd-4317-8f90-05dd4ed97db2", "comment": "Malware payload (RedLineStealer)", "value": "c63a49d3b01eb833231dd9a092cab18e22834c55c2fe7e8dee42ac701ca517aa389f899cfba6b9e506a26489a76479f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787847, "uuid": "b6f7dcd5-2260-4afd-990d-0f98a3561c9c", "value": "T1A4840113EBED8132D9B157B068F603C31A36BDA09D69C27B37859C5D5CB2690693133B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787847, "uuid": "299844cb-d1fb-44a0-9b63-a9b42eb56311", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787847, "uuid": "5ad04845-ef9c-4f1f-b966-0cfb14ceeda3", "value": "6144:Kwy+bnr+Yp0yN90QE/g/eFb46LShUr+zchs23Gx57p+EmpVKWM/kJg:YMrsy90MWUyaIhsXpJmPoIg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689787847, "uuid": "cc4348c0-5ee6-431f-81c3-5806aaf3c36f", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689787847, "uuid": "a64d821d-95bc-48d7-a8e4-bbc5fcb56ff3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787847, "uuid": "52f0dc2c-86ec-4bda-9c05-96b8840cd8e7", "value": "c81eeec11292ccaa7cdbb3db63822d6a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df77fa8f-25f2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (LummaStealer)", "timestamp": 1689743555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689743555, "uuid": "8b0bd54c-a47f-4d51-bb25-7d6ef621151f", "comment": "Malware payload (LummaStealer)", "value": "afb50a605a0becba370f6af59f51ab4e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689743555, "uuid": "d861cc63-7f12-4191-a156-c178bf2114ff", "comment": "Malware payload (LummaStealer)", "value": "28af030636fb2de633c6e85d7e15546fa99c09f40637d38aef2cb28a7957c1e2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689743555, "uuid": "b71e0081-cc8a-4f4b-9b6b-0cb0369e5cd2", "comment": "Malware payload (LummaStealer)", "value": "678b4c344811655f8f895c761023f3e5b010ea60", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689743555, "uuid": "31a6fbac-8d2b-4f4a-bc87-c156ba4a5733", "comment": "Malware payload (LummaStealer)", "value": "62a264220d64a7a666bbd26c2bfef0d29334cd140e4bfd369ee635f4b9960e1facde671b70501b28995bb4b7dd7bcfcd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689743555, "uuid": "b3bcf82d-8e57-40ed-9aa2-018ed9a24ae2", "value": "T17384BE11B9C2C0F2C86315310DE4E6BB9F397A30DA61CDCBFBD40C798A366C1A65665E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689743555, "uuid": "a513179f-5700-4477-87ca-4b3801043ac8", "value": "98aa9f2bca577016f4c3c962f5698e77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689743555, "uuid": "131eefe5-0d6b-481c-84db-d6c9fe8e9744", "value": "12288:z4nR3kPIypkuFRjZBBVZg748xZBdff1fQol:zcL4d3BVPiBdlfN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689743555, "uuid": "e932115d-a543-4116-b8b7-4c36680cd180", "value": 403968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689743555, "uuid": "45cac01c-073c-43c7-b7da-b6ad2516586d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689743555, "uuid": "31b3152b-6847-4f6e-8128-2fcde86fa0e8", "value": "afb50a605a0becba370f6af59f51ab4e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04f8c859-265a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689787856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787856, "uuid": "124a2087-e04a-40b3-99aa-66ee58f561ca", "comment": "Malware payload (RedLineStealer)", "value": "e3376b0ba2a6fdcea2e089d38b39acce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787856, "uuid": "aa76b0f4-77de-4955-b7f8-5eec1779691a", "comment": "Malware payload (RedLineStealer)", "value": "28cbbc88ca25c56c0b1caab0c95c19638fc72ba83e3140f53824ed32f05d3ef2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787856, "uuid": "bb5135bc-dac3-4833-a4b7-dfb356fdd37e", "comment": "Malware payload (RedLineStealer)", "value": "48774869701075862d5e854796dae59d639356d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787856, "uuid": "043b3edf-2bac-4fc2-869b-18ac52ac98a6", "comment": "Malware payload (RedLineStealer)", "value": "a0162416875b79c6d68576475a5882f6477f0bf77b13e7bd5579e313ed60783ee3bbf7553bae9e153558b822cacf1f51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787856, "uuid": "32038a09-362a-44ef-a42e-5e93b92dcf04", "value": "T1D6B40212BAD84572D8B227B05CFA02870B397D959C7493BB3794685B1CB3BD0A83177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787856, "uuid": "77f90c35-7853-4b6b-b641-50d84eb64b88", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787856, "uuid": "9422caab-b978-48ea-9699-ec421ab73301", "value": "12288:qMrNy90datZDRTE8MITxWi//3VFcU1QmOt2WLtUzgzMmVR8OIWZ:Pya6DRQ387/FFdSmFWLtqgzMmVFZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689787856, "uuid": "f53222dd-297d-4ab7-843a-69f45babb240", "value": 527360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689787856, "uuid": "4ec582e4-9692-42c0-a863-386a542985ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787856, "uuid": "1fc3d1f0-6e79-4a86-abf0-5d8b87aa1744", "value": "e3376b0ba2a6fdcea2e089d38b39acce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c435c8f0-2600-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1689749522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689749522, "uuid": "7a991707-cad4-445d-ae6d-dc5327fb9c6d", "comment": "Malware payload (GuLoader)", "value": "2fcda3d124ab5953830e694a4363d69b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689749522, "uuid": "7f056bba-92b0-4219-85e8-1296f8a2425c", "comment": "Malware payload (GuLoader)", "value": "28ed00126e488ec8987bc7d0466a45d6b023c239ca816a3b9b387abb10a3bf3e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689749522, "uuid": "16bc908a-c788-4a0b-99bd-a3c3583692c9", "comment": "Malware payload (GuLoader)", "value": "fb5e34c02f12bc5a711a7560b36003b715295c6e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689749522, "uuid": "2be2cdc2-1e77-46af-90c1-3f243013ab10", "comment": "Malware payload (GuLoader)", "value": "17de9d5f89ab2c26e9e0f6724de0ea451e755406e771c1ceda94c7e658f5226ae1432d21248cc96516b5df8e94ade93d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689749522, "uuid": "34de5a06-989b-4bce-8232-8ca75ab4b4fa", "value": "T1EAF3012D3550C4B7C7A29770993BAA26E9F683164196060F3BA0BD9B38333C6C59F5C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689749522, "uuid": "175a15d3-1c70-493e-9eb5-14dae7f957d2", "value": "57e98d9a5a72c8d7ad8fb7a6a58b3daf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689749522, "uuid": "07ff843b-27ab-4075-a080-fff1c701e9ea", "value": "3072:+NzPHk9MpcQbrUUvrENCd5toldX/z54NlnFqgmnv2drnS1uV2dKjbvVA5RkQIOQ:+hRFrdDhMX/zoBYqjOTdq9Sk7P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689749522, "uuid": "ab5176df-8e3c-4be8-89f4-c94033908da7", "value": 167304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689749522, "uuid": "6786a677-4555-4cf8-913e-01514353739e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689749522, "uuid": "cbbec612-2dd2-4767-89b6-a1d24b62fe54", "value": "2fcda3d124ab5953830e694a4363d69b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86b75ad5-2638-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689773471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689773471, "uuid": "804f3547-7e0e-4c43-809d-b39dc2b9fe89", "comment": "Malware payload", "value": "a4d93c88bcea5a754c24eea5e4230ca4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689773471, "uuid": "1fd3fd10-759b-49d6-8f7b-d4a487870244", "comment": "Malware payload", "value": "29c5a724a320bb5263d8072d2ebb79a63cbd829f7ce75d5b9a6a286c401e58ac", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689773471, "uuid": "bfce5e00-fddc-4dfe-b9c6-e385ba1f53ca", "comment": "Malware payload", "value": "7afdd797cd93e16e8700b459fce8244900b50e0b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689773471, "uuid": "9512b65f-3f78-419d-8255-97578ae86e8b", "comment": "Malware payload", "value": "b17142fc7cd2261a30a5bba371a7fd58adb59f819cdadc7f9d321f62186fc72a5a6a9313340eb52ff0b95d9d70082843", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689773471, "uuid": "a3fb6c31-e521-4027-a518-7931b7a70b3b", "value": "T1C1338D4572A0C073E5A7063519BD8622077FBC629AF480D33FAE064D8EB15D0BA3D3A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689773471, "uuid": "a6d7f7f0-e9f6-49a0-b07e-a1cd23519596", "value": "b3c5e81c2a49c8b00d13a96c67599538", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689773471, "uuid": "2ba1a259-7778-468a-8dde-1a4b3b3e97ea", "value": "768:MehqukkK07MG/Vl8F7PygNbY3yEMWSWFNKJjistyxdjTTtVQ98l7COYPQdBg:MehqvCczASOD7TTtebUBg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689773471, "uuid": "47964d6d-e084-47f9-9dee-a4dbdc68134e", "value": 54784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689773471, "uuid": "70425a77-cb2c-4710-a4c7-1ca21925e2a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689773471, "uuid": "2eac8c76-7a33-4749-9e73-7b4040e5192e", "value": "SecuriteInfo.com.Win32.Evo-gen.28724.926", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "549bab35-2659-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689787560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787560, "uuid": "f9db5718-cf09-442a-9e41-bbeb024cd2b5", "comment": "Malware payload (Amadey)", "value": "9d827bb83640e0913032c63de8cb78f1", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787560, "uuid": "3a0647ee-472a-497e-91aa-f204fde23335", "comment": "Malware payload (Amadey)", "value": "2a2e3be04e8391170c3a71e198b45f6e45c085dff086c4e7b09748919fbeaef7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787560, "uuid": "670d81b6-e176-43d7-96f0-dfd0817ac3c7", "comment": "Malware payload (Amadey)", "value": "449eee66a32c41f5c5aee7d77ded58b575c1b984", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787560, "uuid": "564a8ca8-37a0-439e-a3c3-607a2a5e2783", "comment": "Malware payload (Amadey)", "value": "c1d5381f76c4453ef20ca314c0ee4d06e974880a80e7c0de5383fcd2c7ba9828d0a13c0cc4db7cab31a203c22e882894", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787560, "uuid": "6486d2dd-8848-4196-a03f-0adebceb8a55", "value": "T162B41253A7D98472EAF02B7048F613930A367DE19D78931B2789DD2A0C73794697232F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787560, "uuid": "74359fe8-c047-48df-a004-12aeebf843d4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787560, "uuid": "90f446b9-e9b4-4bef-b82e-fbc2024c2c7f", "value": "12288:WMrdy90DnHgun+muOlzU2R3jp2W8zmUHlz8nlQH:Ly6nHguntu6f2xmal8lQH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689787560, "uuid": "f38cc698-f755-4510-92a6-ad6a2b74203d", "value": 526848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689787560, "uuid": "9d5407ca-c3fc-4698-a1d3-ed6b4a580bef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787560, "uuid": "2cb3d01d-4480-44db-a189-5ebfac399d06", "value": "9d827bb83640e0913032c63de8cb78f1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3adff241-25e5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689737696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689737696, "uuid": "f05f6748-d2cb-4e26-b76d-ee42102a3b5e", "comment": "Malware payload (Amadey)", "value": "144f0c96d774f813d87132e84b2a46ed", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689737696, "uuid": "fb818c70-b7c3-40b6-a5c8-4f1ec5730f9d", "comment": "Malware payload (Amadey)", "value": "2a9f2426bbdd99ab7326d3d174d967810fa63615c225170ea006c7efec1e4d6e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689737696, "uuid": "aeb3a0b1-e5f8-4ce1-8baa-20c3d820500a", "comment": "Malware payload (Amadey)", "value": "ce04450c00f605252c5c7df6960c0a3ed0705ef1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689737696, "uuid": "0910fcf4-2cc2-422a-b8cf-d762a7437ccf", "comment": "Malware payload (Amadey)", "value": "dd29b735a85c6e4dc8ba0a0a03c2a0453956040d43896e7ff3e7068da9858540e6cf37b91659a5f56a13414f0604d343", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689737696, "uuid": "df039e63-9d27-45a2-8c37-20420b96542f", "value": "T1933407557912C032D660617619B4BFF2C59DA828ABB049DB7B800F77DA112F73A70E3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689737696, "uuid": "8680f1fc-341d-4e75-a275-aaf4162152fe", "value": "698e68059e2b8538f873da69a2766d48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689737696, "uuid": "41c5aa55-607f-4de8-8500-5b6e32aad130", "value": "3072:oTzC4usLP+wOULUFAB3i9nyRA4/Prk3huiPFSbuZRuNcZVKOUm8LHIMbffWtsm3:oTzYsLdf/Rity237PFHRuNcPKOK3+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689737696, "uuid": "6f8c04ff-207c-4fd1-a56a-44586fa8fdae", "value": 231927, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689737696, "uuid": "2ece1502-f90c-4ffb-b2fc-0dbd6901f742", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689737696, "uuid": "b6260bee-50e0-4d52-acfc-57659cdd3261", "value": "b2742260.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f738973c-2605-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689751755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689751755, "uuid": "ef93c6bc-61a8-4649-9564-f02fb5e308a8", "comment": "Malware payload", "value": "67b2e2c2a32498c0f6791433c78ab85b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689751755, "uuid": "fcdd333b-2233-4923-8883-ad2928878e10", "comment": "Malware payload", "value": "2baa809d20f4a145bde34e298bff4e7be0f9875f25447f0fe8b953bd56c0e44f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689751755, "uuid": "cd00f190-8a74-4e6b-9fbb-4c975548d582", "comment": "Malware payload", "value": "1d7bf49d315182189059f9edaac3521a0360d290", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689751755, "uuid": "1ea2b27e-59b7-45c7-9d6f-6d7c55c1f274", "comment": "Malware payload", "value": "ee64389673210b004d03f1ebc784debf4b448fa8ddbc77e4a6c4f62e46348b99a91946eb137ab74d440df91ac303b6d3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689751755, "uuid": "e79055a9-3554-4c78-a125-a64850bfc07b", "value": "T11B337D05B2A080B3D5BB063528AE86110A7F7D635BF494D73FAA064E5EB15D07B3D363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689751755, "uuid": "2806fde1-2381-473a-baef-ac1970fe32cd", "value": "48870ce7a0967218f26445c839c51332", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689751755, "uuid": "24189a7d-12d0-437e-888f-8c3e9a85c1bf", "value": "768:r7/hwE0xW90LRO0NlbYu+E4OWV2NK3KstyxdjpTtVQ98l1bOQmwCIYK:PZwE0lw4piKD7pTteAmwC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689751755, "uuid": "0706fa3f-e5a5-4c55-81f6-35127b3ac4b0", "value": 54784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689751755, "uuid": "57de0971-8f77-4589-9615-27c7a0ef6322", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689751755, "uuid": "2a91e573-d0fb-4dee-9456-c6aa2977a2c9", "value": "SecuriteInfo.com.Win32.InjectorX-gen.23328.5398", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13667473-2621-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689763399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689763399, "uuid": "243e4ec6-a0aa-467b-a413-632c57eb9ecc", "comment": "Malware payload", "value": "a24bf45eea278089e9eff33888e5d3b7", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689763399, "uuid": "fb8ad782-2d7d-4e71-92dc-c487c85e781e", "comment": "Malware payload", "value": "2c0134c98971126158f283433e6a02081a96b6334519061128753d14c66ce8cd", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689763399, "uuid": "9c8ad3c9-df96-43dc-8638-db896a04aadc", "comment": "Malware payload", "value": "6de4e1c8a351e57dc2c17277518cfffff3e629c7", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689763399, "uuid": "e21fae6e-d6c9-48a2-9754-d2a56a623d24", "comment": "Malware payload", "value": "245a3b2cd54f4dbd8b60b9585c7643318ec41ea41a5cb5bb90f95fc73d190ad2a70d0f91d8ba79361a9320a2b6d309e9", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689763399, "uuid": "60f7fe26-cada-4426-9501-0d25a657a006", "value": "T13F62AEADECD0CA8FD587543A90955265E99F81DCFE5A011F1C883BCE22A1CA44B36DCF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689763399, "uuid": "78e1087e-1e80-4887-824c-0e994730e677", "value": "384:ONolw7qbeP46BRzG0PGvQsRPgvjpyhYUiS7D:Aoi7+YzGOGvv1gv9AYJSn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689763399, "uuid": "0b873a57-a9e4-44c6-b14f-a05f3b4a8823", "value": 15883, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689763399, "uuid": "01dfeff6-f7df-4577-a7ff-f7dc03e04506", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689763399, "uuid": "2872308f-1811-4fe6-9f63-3ac2aea99b4f", "value": "Fax Message.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b42b935c-262b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Cobalt Strike)", "timestamp": 1689767964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689767964, "uuid": "1dd60d68-de05-4b3c-b7f2-810c56db869f", "comment": "Malware payload (Cobalt Strike)", "value": "68b90a417d791f1dec25416d1dfb3d7c", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689767964, "uuid": "cebee6e7-4aa2-4365-a745-6c845fca5c56", "comment": "Malware payload (Cobalt Strike)", "value": "2c593089c490455039542e64826356d85ca09c1e2dba673b5a9aa7814bd17959", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689767964, "uuid": "064adecf-f5a4-451d-957b-57a5f0526054", "comment": "Malware payload (Cobalt Strike)", "value": "45b51722c661c1fd6abd9ef46da86b518908d663", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689767964, "uuid": "73cf6e50-0306-4be5-bd76-6adf05492da7", "comment": "Malware payload (Cobalt Strike)", "value": "11b6e94a70a8cea25acee142546fa44fcc0d92580afed116384a8ae9407ef9502267b3e2035f1c60af7384174c0d8508", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689767964, "uuid": "3c11e247-640c-4ce9-b41b-608b119d682d", "value": "T145B6AE33B94265F8DAEDA531C52556127E343C8B5B2023C73B40B2BA3A7BBD45E39394", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689767964, "uuid": "468b3a34-d8da-44c6-ac7d-845b9b0392fd", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689767964, "uuid": "3a20cb68-3ee6-4672-aa10-7ba91cbd0965", "value": "98304:g3zQRZL8+SzwirEo3FRGtPJqqmBmWtZo6vVD2JqgriCmH:4cnLkwL6RGNJqqmXtZoCynriCm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689767964, "uuid": "055921d0-157a-470f-bd0c-a6983d09571c", "value": 11107328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689767964, "uuid": "cc08a445-13e0-43fe-8de9-11a04d932003", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689767964, "uuid": "6e1bf795-3914-4c9a-9eb5-0528619cff5a", "value": "mhy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76992536-25f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CustomerLoader)", "timestamp": 1689745527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689745527, "uuid": "02a9c9ea-fead-46d3-8b85-07e4b3fe796f", "comment": "Malware payload (CustomerLoader)", "value": "1532f0bee9dfb0dbf1255deb0bf903fb", "object_relation": "md5", "Tag": [ { "name": "CustomerLoader", "colour": "#57A5C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689745527, "uuid": "33cec7ba-287d-48c1-97fe-53daa5b23909", "comment": "Malware payload (CustomerLoader)", "value": "2cf82af2783ce05445c94dd82b00653b2f8447aa80d10b5831c4d601b888fc98", "object_relation": "sha256", "Tag": [ { "name": "CustomerLoader", "colour": "#57A5C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689745527, "uuid": "e9255ba0-40bb-45ac-ae23-cf30159ec8fc", "comment": "Malware payload (CustomerLoader)", "value": "c99017b170fd088be49c9d684d080f18e2aeb609", "object_relation": "sha1", "Tag": [ { "name": "CustomerLoader", "colour": "#57A5C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689745527, "uuid": "59ee30af-3368-4fda-973c-a9e5e33fd531", "comment": "Malware payload (CustomerLoader)", "value": "95d2b278b46990abac66832559518f03e215d220fa91b685bebe39e5b5aeff5740e96189b3c8e12f548fa1909784045d", "object_relation": "sha3-384", "Tag": [ { "name": "CustomerLoader", "colour": "#57A5C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689745527, "uuid": "f4985320-1f58-40c9-bb9c-f30269909050", "value": "T13A03DF0407A801B5C6671B7DDCE2034307396F77E46BDF8BAECCA68A1D1332867226A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689745527, "uuid": "aa961594-c6e7-47ad-9fb6-731b4f0e0154", "value": "768:vlntUMmjH+43M2F7Tllmu24Ra2DovIieNhIPVQPabLg:q+92JTll92m7ov0oW4Lg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689745527, "uuid": "be57c8d2-97e5-4ed7-b269-b12943e779e2", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689745527, "uuid": "88965eab-c9fc-48aa-854b-f6daf785e93a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689745527, "uuid": "af31e622-aa90-424b-ba70-db1feb6c5adf", "value": "Order_ JUL07 01BB77FIBA00541\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e97e075-25fe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (LummaStealer)", "timestamp": 1689748386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748386, "uuid": "f4f4dff2-9ed4-4a97-9df9-23a700bbcb29", "comment": "Malware payload (LummaStealer)", "value": "c331bb9e24a0d10bc2a1452705aaf95b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748386, "uuid": "1002bfa3-fd5c-4f1c-89a2-1787ba9def62", "comment": "Malware payload (LummaStealer)", "value": "2d3adc981781d161d2420edb7836149d0cfd485ed487012609ac3e3573089796", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748386, "uuid": "b8d54238-eb93-4174-ab7a-08442da8bf72", "comment": "Malware payload (LummaStealer)", "value": "09849f55e1b9e19b45824a01e1654acafdfef3ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748386, "uuid": "7a80a6d3-ac0b-4636-bc09-0d409fce139e", "comment": "Malware payload (LummaStealer)", "value": "99fc5fc58e23418acc2cdc32e9a01edca389b37be8066f1f23a096614ba9f169eff73e7f5dcfa426af47b456fec09dc9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748386, "uuid": "ab281621-a412-4fed-9074-ac731c3f254f", "value": "T17B840103EBE58536D9B52B701CF602831A327CA29D7083BB27466D4F1DB26C5A87177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748386, "uuid": "c6194c49-a480-4605-b3c3-41f2e18a4d49", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748386, "uuid": "4df89b76-4c44-4a1f-b67a-59624a2cbad3", "value": "6144:KKy+bnr+fp0yN90QEueGlPeyRhVXmIg2ClExUypHLR902yWO6/bXKnKtdh:6MrHy90pGlxVezlsUyp42j/bXKKtdh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689748386, "uuid": "b6e028e1-19f2-491e-b967-d05b9ada6401", "value": 398336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689748386, "uuid": "e1e7c2fd-1f4c-47fd-bddf-3d76842a8636", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748386, "uuid": "27fde281-c84b-45b9-aa21-f8270ab25f04", "value": "c331bb9e24a0d10bc2a1452705aaf95b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3ce2859-25f8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689746139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689746139, "uuid": "150ac13c-d99d-4d9e-bc0c-ec80bbcc4e76", "comment": "Malware payload (AgentTesla)", "value": "f878c9cbe2b0447a108032df274e7f74", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689746139, "uuid": "09255737-5a7a-457d-8852-bcdc44003f18", "comment": "Malware payload (AgentTesla)", "value": "2d6e0405a2a3b73566f01d21c9747d6a09e65a0b093f980d915d3cb3f1ff89b3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689746139, "uuid": "8e06df8e-ec23-4a84-87df-a627e9e66b6a", "comment": "Malware payload (AgentTesla)", "value": "a25d519a8093591bd3a953b7bc0d39864723c893", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689746139, "uuid": "1fd938d4-2b74-4291-94e2-121c94b58d93", "comment": "Malware payload (AgentTesla)", "value": "59392862d48c0c6fd32bfc8a39be8549770f29d920ad210f89a4d735c0ed1d4657e4a4b8d550a112c1e52c84ac934042", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689746139, "uuid": "67e7d262-e672-46de-9627-85f28161b046", "value": "T115D422581EAAD60BD5676FBC000022B0C1399EDCB552E6B32C1FB0E6E705F5E8E85B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689746139, "uuid": "d589dc5e-c253-405d-97cf-8e1c1bf424d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689746139, "uuid": "d2610833-c47a-41f8-a1b6-938211fde625", "value": "12288:zmAY2kcdbL4Ef70MESJNvl4UDrCnxFKp4GCp2NFkHh/pf/qKko4MmVNso:yN6GEf70MEqhiyyxtmKmoFmVNso", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689746139, "uuid": "c0851039-8fd4-48b3-9d5d-68c98f312141", "value": 627712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689746139, "uuid": "e1164560-bacc-4b07-8688-f2f9d7f70181", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689746139, "uuid": "2ef10814-e77a-405c-8032-a677a0ea456a", "value": "SOA OEC Freight Korea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a894cf3-25fd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1689748110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748110, "uuid": "f6d6e39e-7bfe-4a94-bb2f-abdab061dfab", "comment": "Malware payload (GuLoader)", "value": "022813fd0e792148a6839ed9d54ad97b", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748110, "uuid": "32d8385d-3d2d-4905-b12f-109ab6eabe4e", "comment": "Malware payload (GuLoader)", "value": "2dad963ab06804c452be451dd20325ded539bf1d6acb5baa5471fe0bb2ebb7f4", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748110, "uuid": "04bbb02f-6db2-44c7-8dd6-946ecf0c831d", "comment": "Malware payload (GuLoader)", "value": "19187a28413ed4eec3e4624fcab4cd0ec41fd422", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748110, "uuid": "e5806662-b3ee-4cf5-8558-0b81e4d65a1b", "comment": "Malware payload (GuLoader)", "value": "9cef7bf36e2c473ca6f3a2398b6b5efb6c41c91a89aadbf0df4b275e59bea4f58fbc4ad57fa43f531c49648ceca7c025", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748110, "uuid": "c78c6c44-f19d-4486-95b5-9601c3f0b09f", "value": "T18B7633D5DAB46BE5C208C5375232A8AA191DAD5CAF4CEC01BD8037CC3CB1BB54ECA957", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748110, "uuid": "47c648ed-97e7-4546-abba-fc5739a84992", "value": "196608:Gwj45V3uCNlf5pOJwRP8fV0hvs/kgrYLEqgAVaRY/mXENmAP:jjCNlfGwREgvs/lELTg4+Y/3oAP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689748110, "uuid": "bc2d4c22-e4de-407e-9bfb-2b0836a16543", "value": 7385104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689748110, "uuid": "dc7f9646-fdfc-45e5-a28e-e1044ac1bdde", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748110, "uuid": "768e5c9a-9986-4c79-8507-5790fc8bc919", "value": "double_penetration_schoolgirl_in_park_ass_torn_photo.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aebf16c-2614-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1689757828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689757828, "uuid": "e74ff72e-f670-47a8-8110-a108c4bb1f3c", "comment": "Malware payload (Loki)", "value": "5e4d39e60ff35813b11c0f7875c87d38", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689757828, "uuid": "bd79ad27-3ed9-4e33-b024-d14925612b49", "comment": "Malware payload (Loki)", "value": "2e0d0762433ff21184bb4e8330db8fa104958537fad81fb39d8e3e7d849ee9f8", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689757828, "uuid": "3b89f495-2708-48a5-a148-49682cf1e864", "comment": "Malware payload (Loki)", "value": "b7664d8f8182e736a3cf4509c5a38fb1c17a7fad", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689757828, "uuid": "c8c4a7a8-7902-4c70-b88f-9f8dda945c39", "comment": "Malware payload (Loki)", "value": "769da68edb596ed8d137f555b9e27824115ad1f9d64d30ca379e98e157661117281079cc10c1a0ac51d6194d5bf1b45f", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689757828, "uuid": "5452749e-e1a2-4011-bef5-7c3a08c352cc", "value": "T161C402557D978513C00A2F3BC04225B443BB8BC67923D61B2C8FB129AE9A7CF4D90B97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689757828, "uuid": "134c4857-946a-47a2-ba0f-56d85e9b872a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689757828, "uuid": "d8092b0b-b06d-4b4a-8ad7-8e2e7cc02c30", "value": "12288:trFfAdymAY2kcdbL4EfMRD9QMKOXSehTZk1lhlcGifGL6fq0:bfoN6GEfMRhKASehTC1lgyW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689757828, "uuid": "4f34922c-530e-4aae-8779-829b48cf00f7", "value": 574976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689757828, "uuid": "7c79e0ad-276a-47c0-823c-989527dfcd47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689757828, "uuid": "8ffdb23e-91be-4a06-b47b-1e97bc4e6bbf", "value": "Shipment Document BL,INV and packing list.jpg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1042756c-25f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Glupteba)", "timestamp": 1689744067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689744067, "uuid": "b855d05f-804b-4680-a7b8-624ed37dd175", "comment": "Malware payload (Glupteba)", "value": "d758df3b0e8d4443342d910d03ef0112", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689744067, "uuid": "86809941-3924-4e63-92f7-8ea99bfaf533", "comment": "Malware payload (Glupteba)", "value": "2f569e9b69fc4f9fa6bdf174136418488acf726271019cffc60cddfc03f7c47d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689744067, "uuid": "ec6f312f-2a59-4f11-8429-22ef388ba415", "comment": "Malware payload (Glupteba)", "value": "d0774cc4d4b6d89ca8b3022672aea0e633eeddeb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689744067, "uuid": "a1a00946-a36b-4533-87ab-978da9e37d6a", "comment": "Malware payload (Glupteba)", "value": "4d26854f2731f382882af99498515f8dcef4e73b6d56142147db87843fb534dfee1ae478579c0813075ca18b53bb481c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689744067, "uuid": "190b3630-b1bc-4197-8961-111ae2bc43ca", "value": "T1B91633316BD1D4B8E437D33488A0D9C15F5A7446CFA12D9ABF8026BF2D11EB059783BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689744067, "uuid": "b69af7e7-582c-44ae-8bd1-defe123f3ee1", "value": "e3ff19f7172c13237bee4639264542fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689744067, "uuid": "cd8b529f-232a-418c-998c-cd3ef0c404c1", "value": "98304:Qt54j0P2hjJO7KE08AWtEpyK+4lQo/60lxv4KSUh7+:5JMeE08FU1U90lh4KS2C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689744067, "uuid": "4dc4be75-b677-436d-b441-46ff2feb5d38", "value": 4339080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689744067, "uuid": "d04d8b84-0002-473c-b674-c1c003671d15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689744067, "uuid": "68d4346b-eb55-429b-850a-20934ce7c577", "value": "d758df3b0e8d4443342d910d03ef0112", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83c5d6da-25fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1689747696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747696, "uuid": "07cf4b5e-032a-4745-9a27-6bc71c0b6391", "comment": "Malware payload (RemcosRAT)", "value": "823328aa4d9437a6c338e145a6642a06", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747696, "uuid": "e8f6d310-19c2-47ac-9c13-e08a2c5fdff0", "comment": "Malware payload (RemcosRAT)", "value": "2f6f8d08fcf273fa79b7a13d3b24d4f71bbc9f2fdf6965afd737ccc0d5316429", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747696, "uuid": "7dc30ea5-b0f8-4791-b578-f846596842e7", "comment": "Malware payload (RemcosRAT)", "value": "56d0b1a5047f7f247a26002f1e9d6a2ddf834262", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747696, "uuid": "b4d5c967-1ad4-4915-b093-9bbab5a10346", "comment": "Malware payload (RemcosRAT)", "value": "6ee0c311a71fe38aa3e5e4767287e7bb44195a0141cd4310888e5d8b2e8d3ff3e485dac5384724c3be648047d603691c", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747696, "uuid": "27fb2bff-e0b9-4ea8-af2b-9c0884eb426c", "value": "T10615F28C67F0412ADB9E07B97878A30CD26DE49F2163938EC448BAA93735674C9F1753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747696, "uuid": "f12f9c18-9fbd-4c84-a1bf-d256fe1d500d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747696, "uuid": "fdc49bd0-81b3-497e-bd2e-d6dec95a94f0", "value": "24576:A0tGByBT/FzVEbaoTAGNdqHKZh6Qf8OGXAWfbHAL:nfhSa5GPt/8OEXcL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689747696, "uuid": "487d1694-d5a5-4558-aeac-fb5cdb0da6fd", "value": 891392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689747696, "uuid": "a9a1cacb-c1c0-41e2-967c-ae42aee01c2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747696, "uuid": "295a2e2c-ee30-45dc-bc1d-7ba772c64429", "value": "Optima Bank_ \u0422\u04e9\u043b\u04e9\u043c \u043a\u04e9\u0447\u04af\u0440\u043c\u04e9\u0441\u04afpdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f37fab8f-2634-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689771936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771936, "uuid": "ea58bc58-72e8-4f7b-a429-aa7a7ec36095", "comment": "Malware payload (Amadey)", "value": "88cd3287b5c63e0998547f5d6f44ee26", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771936, "uuid": "faa35a08-9207-4f3f-9be5-a6e9707a5121", "comment": "Malware payload (Amadey)", "value": "2fd7c050fbac5e1af2ffeb7fa80c3d86adca912aa0593a6fcf0ada9f513ba783", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771936, "uuid": "6955f4a1-0cb4-4ad7-b283-dcb6ae332d9a", "comment": "Malware payload (Amadey)", "value": "34ee86ef1950746fb4c38d73de30714f35a49dc9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771936, "uuid": "58f9abc6-8a90-40f4-90f9-c917b87a0ee1", "comment": "Malware payload (Amadey)", "value": "c9f0d7b3f35c479c86263cb897807298238975c7207f372f11374b2da3708823d4d93bf43a28eec0a50ca6831bb820dd", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771936, "uuid": "ffc8f144-64c6-4d23-a5b7-fe40aefea3e5", "value": "T1C8840253A7ED4132E5B82BB058FA02830B367DE05D38936F2755A94E4C73594B93273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771936, "uuid": "85fe334a-3bb8-4b65-810d-1b1cc9003e79", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771936, "uuid": "f28df02c-c494-466d-934e-fa5bfe6b11b3", "value": "6144:Kuy+bnr+Sp0yN90QEnqLaM6P8is7lQuxVkkm2ptpk9h28:GMray90GJtKuikmAq9k8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689771936, "uuid": "d4af4bb2-f1e7-42d2-b10c-72569b149635", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689771936, "uuid": "e163104d-4765-4de2-bd02-72da11e46e41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771936, "uuid": "d437ff4c-0e5b-43c2-af0b-68e5e87670d4", "value": "88cd3287b5c63e0998547f5d6f44ee26.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dd20b15-25fb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689747096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747096, "uuid": "371b86ca-e282-4fb5-a42e-46b7391dfeae", "comment": "Malware payload (Mirai)", "value": "923bbad0795424483767198393635f64", "object_relation": "md5", "Tag": [ { "name": "2-59-255-213", "colour": "#A4F8B9", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747096, "uuid": "d05047ae-02e8-41ba-a71c-21487cfc9a93", "comment": "Malware payload (Mirai)", "value": "310b6350bb7f6105ef5d5aff1eb4264de3459dbfd2fc0ae9baf145b37c6d7a3d", "object_relation": "sha256", "Tag": [ { "name": "2-59-255-213", "colour": "#A4F8B9", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747096, "uuid": "0ca59d94-487c-4ddc-a38d-018c266d60d3", "comment": "Malware payload (Mirai)", "value": "483a52051c6b158df2602ee663009f3d3e35abe5", "object_relation": "sha1", "Tag": [ { "name": "2-59-255-213", "colour": "#A4F8B9", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747096, "uuid": "c18ba88c-a146-4b6f-92a8-1e6e00677df6", "comment": "Malware payload (Mirai)", "value": "44911cd1765799c20f4571796619348cddfe28ed232eac2f35e820b7e141cf9bb8624b396f619acc14461fa851b896a2", "object_relation": "sha3-384", "Tag": [ { "name": "2-59-255-213", "colour": "#A4F8B9", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747096, "uuid": "afc7633f-451b-41cd-81ab-0f33cec3b2c9", "value": "T1C4C2E0F8E1984DC9DE6D2C524E39DED51BD1CFFDA31ACE9211819F10421BAB93741AC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747096, "uuid": "093b6e42-52f8-4cd7-8f45-1f1dc83167e7", "value": "768:bWaYjNCFOYjerzOC0fI0zu+jFTya5r4uVcqgw09X:ijauDT0q+jFTrr4u+qgw09X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689747096, "uuid": "72ecbd03-cb87-4752-bfaf-b0f27df22b3a", "value": 27408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689747096, "uuid": "23c338e6-954b-456c-b879-a63b4cb4d2fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747096, "uuid": "be28ce9c-a885-4fe5-88f3-b347559cf85a", "value": "sora.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16dfc3f7-262c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1689768129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689768129, "uuid": "6db569c1-0c12-42a8-b584-f5c27c40cea6", "comment": "Malware payload (Loki)", "value": "75fbc939b7644359a5ad9acaa578c222", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689768129, "uuid": "d2e3e736-91bd-4509-a087-f735fdcfc7c9", "comment": "Malware payload (Loki)", "value": "312deb37d14c63aefe2884680c218432aefc510a565aa68ed584d35c839ce694", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689768129, "uuid": "dd7bcba8-c4ca-446a-a150-093fcad4c96c", "comment": "Malware payload (Loki)", "value": "dadd79230008669925be29bb8d1a18eee443863a", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689768129, "uuid": "33fbf009-6ebb-4e90-95f6-4057eca3a6ab", "comment": "Malware payload (Loki)", "value": "4f9295eb5a0de8fe45c9730d1eef959c7a45d790e6a956be707e27b8fc369f4301e125b7940b3bbe18685eb1eb1fb48a", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689768129, "uuid": "bdd3e8b9-dd65-4333-9a46-0c8d73790df0", "value": "T1C6B423EC877CB227657E4C3414E0EAB626829A54BC4DC3C64EBE8F14D7CC07D5A2526E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689768129, "uuid": "40620b5c-67a1-4d7d-bce0-43c449a91b6b", "value": "12288:tcU2gxvS2P3i3ua/Hjd+775PtoNAOnKM0YrA5Cv8vn9:tcUXZS2PGboHfoNADYVvg9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689768129, "uuid": "214e84c7-7edf-4226-85c3-354b5d4546e6", "value": 519551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689768129, "uuid": "d9437b1e-db0f-4ecd-9f67-b1770144f1d8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689768129, "uuid": "976e9648-df12-419a-b215-dac971fb392f", "value": "PO-1193353.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21e821c0-25fe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Lu0Bot)", "timestamp": 1689748391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748391, "uuid": "5c7235b9-e9dc-4429-b0a8-a69c8a49f06d", "comment": "Malware payload (Lu0Bot)", "value": "8368b877e634ff66c575dec32e44e1c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748391, "uuid": "98165ad4-ac45-43ba-946d-2022e2d28eae", "comment": "Malware payload (Lu0Bot)", "value": "31fa43d98ac742905cf04735033e154fd103bc67c255cec63a7448ad138df0cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748391, "uuid": "e76a737f-3d47-46fe-8e51-fae65103df4d", "comment": "Malware payload (Lu0Bot)", "value": "fbd1011edabf7e5075a60be544e6cff997d05c6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748391, "uuid": "cbfc747b-bab7-4065-b450-d87efb53a274", "comment": "Malware payload (Lu0Bot)", "value": "cf12ed6fe6b2570515ee5057747ecc3d7594ccd4b1648e73faed6cbb0b4645530c1c9157cbc0a6cee9dfcedb12b56a48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748391, "uuid": "8c5b78e6-e108-4e94-9100-aa3bde441b39", "value": "T1E0C5330652C97211ECE337B44EFA23E71C387C80A7721BA7291CC8A915B669894B577F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748391, "uuid": "c221132d-dedc-443e-b3dc-35ecbb28d8c9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748391, "uuid": "32bb4903-c093-4763-b005-291336979060", "value": "49152:E4i5RGU3BzRFRcXkEGNs9uOTb/hvHV8omIiguWHU0S0UMof8ts/CqMDYLByly:nMRl3xXiU5El18omGVyCo9Cd0ByA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689748391, "uuid": "15699300-702c-4974-80a2-b4d6dfb81b9d", "value": 2633384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689748391, "uuid": "567afb76-b675-4d3a-9e21-61b3032697a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748391, "uuid": "e9cfd730-fe97-477a-9606-91b7eb1da7ba", "value": "8368b877e634ff66c575dec32e44e1c5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f149c7e5-2634-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689771932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771932, "uuid": "9dec268a-125e-4afa-9b84-e6a1f513344e", "comment": "Malware payload (Amadey)", "value": "b48f4d5e5ebbba5540571afc35141edb", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771932, "uuid": "894c60b1-c21a-41f4-99f6-835f3135a217", "comment": "Malware payload (Amadey)", "value": "32df5b0360337fb2cb7c64f82fa3d8fde28ff3c1028c424475918553f0dae959", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771932, "uuid": "d614298e-6a7e-4f45-a599-1fc86941c94a", "comment": "Malware payload (Amadey)", "value": "c17c04823151ba15dc89d1dfc7ce39ab04f007ce", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771932, "uuid": "50d12828-9f7a-47a9-ba3f-17bb5e21b91d", "comment": "Malware payload (Amadey)", "value": "32e6a682ffbbe667592528e015da22d8c0c2a4712686272285960cb0fe45194828a8cb9b3ec416b1df555f0e2fedea2d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771932, "uuid": "2f697e00-ab02-4651-ace2-ec5a3d543168", "value": "T1CB840113F6F94432D8B557B098FA13D30A357DA18D78932B2795A98A0CB36D0E53273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771932, "uuid": "7eb94a23-70d5-4bf9-95a3-1b5c9f67fecf", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771932, "uuid": "54d6cd3d-4f9a-4e89-b64b-4dac8f5ad53a", "value": "6144:KTy+bnr+Qp0yN90QEqBbYug653PMwusov9HGDMtgb99PpXrEd4+e2F1zdiZ5MoVY:9Mr8y90fh65kflNgQgbNrxOSVMf1d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689771932, "uuid": "b080fc48-21c8-4307-b00f-a14f3367738e", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689771932, "uuid": "799e77ba-170f-4263-a08e-7bb02ff90afe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771932, "uuid": "66a8849b-10b4-46f0-9413-8ddcc6d4a003", "value": "b48f4d5e5ebbba5540571afc35141edb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a9c3fed-2655-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689785745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689785745, "uuid": "9627dc27-6a43-4634-a56d-c9d7a8b2dcf3", "comment": "Malware payload (RedLineStealer)", "value": "65739369626fad4bcf9371ab192066c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689785745, "uuid": "a2c8e19d-8de7-4e74-9972-0ccf771b75f4", "comment": "Malware payload (RedLineStealer)", "value": "33172dc686d2b349184ae32dedf6ca1296e9790aca1dbe97a6847f2b3419083c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689785745, "uuid": "da6bf66e-814e-4e1a-b9e0-bac8a9ac58b1", "comment": "Malware payload (RedLineStealer)", "value": "6dd1f3bfdc3be989fafbea644f91980927ef6581", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689785745, "uuid": "d814e8d9-5d2b-4641-b5fa-44f24b7a2e87", "comment": "Malware payload (RedLineStealer)", "value": "8ced5a40dfe8f2b9c3fb3278f399bd7b6d412ba923af968bc46484e8bd877907fd670845e3a9e1dcdf404ade4ffb4aad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689785745, "uuid": "8036bd3c-62e0-40a8-9c7b-b50e2fd3d00a", "value": "T1F474F212F6E48033D8F11BB058FA03930B367DA19DB8536B674AA94D4C72AD0A57637F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689785745, "uuid": "4a8a9659-7a75-4ce3-b606-df78bd4ea5d6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689785745, "uuid": "673a6d0d-eb34-412d-a03c-773faa88bf6c", "value": "6144:Kcy+bnr+Mp0yN90QECm1v8t5MZSLxX8d6XBNTZpRj+ObNw8oWKQSv:YMrUy90pvXSLQGffbWF2Sv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689785745, "uuid": "02e9b037-93cf-4e89-a74d-3efd497fe12d", "value": 367616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689785745, "uuid": "e1d3a130-790c-4226-8c17-3749e1de7c5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689785745, "uuid": "eca39e72-eea7-4301-927f-ebd777fc0c26", "value": "65739369626fad4bcf9371ab192066c4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bfe59d9-25ee-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1689741617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689741617, "uuid": "f29276df-94c9-4668-b108-7418d621e884", "comment": "Malware payload (DCRat)", "value": "9804a69053af56673b50bbae936d87c4", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689741617, "uuid": "5ea7f215-cec0-49df-acf1-06711f866eca", "comment": "Malware payload (DCRat)", "value": "34669303b4576c514968ee0ddacf5504afc564c02dc5f04e4bd396d824a14cc1", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689741617, "uuid": "ef01d5d5-f88e-440e-9a53-4c331003c33b", "comment": "Malware payload (DCRat)", "value": "4f4cf5939400260996badd4aee877e3b3d4fb5a2", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689741617, "uuid": "93061d73-34a6-45e4-bd3e-845d9b535b07", "comment": "Malware payload (DCRat)", "value": "be88f8b730e778b503754e59fd61722ea9a157aeebc6283d8d9626478ad1d643d7053c8f59c6415db037f05790e2e279", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689741617, "uuid": "7027698e-620f-40b3-8e20-fc4a818b9a44", "value": "T134451713BA45DE03D0291637C9EF943847AAAD413662CB1A7F9F339D64523A70D0E9CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689741617, "uuid": "d180feb2-ed6d-4fd2-87d3-87cd0e1dd34b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689741617, "uuid": "ed309685-8dec-429e-a8a0-ed9f96a42a41", "value": "24576:K2spvWL9p6AgC6T710oxNyP4FNIy+tbDmi2TW+4:KH5W/NAxXoy+5D2Tx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689741617, "uuid": "1fa1e54b-af28-4da2-8719-f20aed98720b", "value": 1189888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689741617, "uuid": "271ef208-09cf-47c8-958a-39520e6417f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689741617, "uuid": "1d60aefc-f13d-4bbd-a31d-2d33bc9f10df", "value": "HEUR-Trojan-Spy.MSIL.Stealer.gen-34669303b457.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "502c6629-2659-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689787553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787553, "uuid": "0ffd576e-7b78-4a5e-97cb-158dbb3e5ab3", "comment": "Malware payload (RedLineStealer)", "value": "7b738b1b6793e8e4c00d5d7523b6ac73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787553, "uuid": "ee078482-a94f-4261-bb3e-d90f3a7cf008", "comment": "Malware payload (RedLineStealer)", "value": "34689f5f7fa1e0371ad23bc8cae8ea539aa6bf729a9ecce128963ec133fb1be1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787553, "uuid": "4ecd00ef-aa03-49f8-9e23-059af66a2801", "comment": "Malware payload (RedLineStealer)", "value": "377b3326d763c360244718d4bc743b870e100857", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787553, "uuid": "917a8593-81e7-4228-9e76-0df42278b921", "comment": "Malware payload (RedLineStealer)", "value": "bd8bfced1b51e6cda9fa1e0ea5e92992356093540f180fb822492645e360d25ff592e5eb17ed2d72e4fe179bdcb98b4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787553, "uuid": "7435c7be-af5b-4b76-95f8-43f3864615ed", "value": "T13DB40292ABE89072EDB91F7098F717831F367C625D38566F3B4188891C73AC0A53176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787553, "uuid": "230c3d36-306f-480f-97cc-50e6145817dc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787553, "uuid": "5e82963d-7de3-4b81-898c-5aff4ecea508", "value": "12288:nMrVy90FXZdAHWUY2mS+ljNFk3NKu3nxLZrePMA:ayCDAHWUY2mSpKu7r5A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689787553, "uuid": "0af25705-d101-4cdb-ba74-8547feef54b7", "value": 527872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689787553, "uuid": "f1441ea4-8d3e-4bb4-83e9-4f18141b7643", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787553, "uuid": "9e8e0b98-a8ab-4e71-bd9e-c24b91f553b1", "value": "7b738b1b6793e8e4c00d5d7523b6ac73.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e579b08a-2665-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689792957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689792957, "uuid": "20b51e62-b809-4c40-8202-848b52d60ce9", "comment": "Malware payload (RedLineStealer)", "value": "05c38101649835c2baad888deab4c66e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689792957, "uuid": "31151c33-fe9d-496c-bca4-e6b370bef06e", "comment": "Malware payload (RedLineStealer)", "value": "34b8fdeeafe15c31ab10314949d8d534bca5cfd6995d47dbab8b3506a2847a27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689792957, "uuid": "79ada8c9-9521-416f-a7cf-32621962761a", "comment": "Malware payload (RedLineStealer)", "value": "912349f3fecc2be742f9f83ed646e6828d32608a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689792957, "uuid": "4b141b39-7cc6-42a2-b102-996f4322d46b", "comment": "Malware payload (RedLineStealer)", "value": "80efb7c98efac13c514cc0d8982335c21f02d2ee9b4b6b03b3a350871e29c54938ddc4a205c889e177e8dbc97208da4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689792957, "uuid": "ab17b7a5-dde8-4133-87b7-dfb0dbe94be5", "value": "T195840142E7E48033D8F51B701CF612830B3ABCA5AE74836B2395994A4DB3985F57277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689792957, "uuid": "e736f640-036c-43d9-9aba-43a63e34609f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689792957, "uuid": "351959cd-6a0c-4d78-bc06-263e0fbcc53e", "value": "6144:K8y+bnr+ip0yN90QE7h7stzBYwv/aYxUsjmLXsiaZ+CcHnlRHu5lpuObxYinjsU:YMr6y90Jhy60Xjm0lcHnl9KrbylU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689792957, "uuid": "95ad51e2-aa80-42a7-a9d8-4bc110c336de", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689792957, "uuid": "dae30d58-de6c-4b8a-843e-d463a52cf885", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689792957, "uuid": "1fce049f-e3ac-46f2-b8cd-3ca19951827a", "value": "05c38101649835c2baad888deab4c66e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a83c44f-262f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GCleaner)", "timestamp": 1689769397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689769397, "uuid": "513dde2e-2500-4ff7-a8fb-a82954f4be48", "comment": "Malware payload (GCleaner)", "value": "f48f880e88a5b4ec0dbcbce5edb4a3b0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689769397, "uuid": "069a6225-57ea-4605-a103-8a164f83f933", "comment": "Malware payload (GCleaner)", "value": "3520a182733b71fc372d8f2ea23cac7f848a4efa88a7de93048eb4beaa4bbd3c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689769397, "uuid": "ecbdcf4e-4b7a-411e-800e-e6d0c337455a", "comment": "Malware payload (GCleaner)", "value": "26c02410217f9f2408badd219d98ac910a505402", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689769397, "uuid": "e1837714-a13f-460d-a482-3eff52f2bc0b", "comment": "Malware payload (GCleaner)", "value": "b67ee089f39aabc47fb45b8bf46c24f177466299ea5f65d473e5371d007dff58fd120eab915b787fcf0b5cb0cbab4655", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689769397, "uuid": "c3091cda-2d0b-4688-8d9c-d907474188d4", "value": "T10374F12232A0C032C5AB6A3085B1D692276FBCA2673556CB3764367E6F317E14E34797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689769397, "uuid": "92d5b007-a621-4e39-8676-6d4e09a3777f", "value": "6d688d9cc0f6602b42d54dce0edb5c52", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689769397, "uuid": "c0bc7cff-ec2e-481a-8772-3a0bdc3744a3", "value": "6144:sZVTsjiPCzeKZLafyvzS7v5m/AU7sbdbreZCWEi:S+jiK/ZLaEz2v5EnEdm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689769397, "uuid": "baa91bf5-021d-4dd9-bf19-a3f396f73a04", "value": 337920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689769397, "uuid": "860243b0-813c-4c11-9e41-505e0add4717", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689769397, "uuid": "57c47448-a765-4ec6-bb34-b5532445f118", "value": "f48f880e88a5b4ec0dbcbce5edb4a3b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5814103-2607-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689752477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689752477, "uuid": "bdeb41be-ddda-481a-8f42-b10500662c4a", "comment": "Malware payload (RedLineStealer)", "value": "0395d6d44bdd51dab4a38ba16f7625fc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689752477, "uuid": "ddbb5514-ca7f-4142-9084-8744890e0c04", "comment": "Malware payload (RedLineStealer)", "value": "35bec8209ce812572a8ca75f137e8c2b6c1271fea7c96a72a4e08087b640fa0c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689752477, "uuid": "0f924c44-7c17-440e-8b83-f5f567305458", "comment": "Malware payload (RedLineStealer)", "value": "595adec9a732a167bdd46e7915680c8c59945d41", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689752477, "uuid": "bbf782fe-907f-4fe7-a1d2-f140ce2d93f1", "comment": "Malware payload (RedLineStealer)", "value": "55d8ec98d98a9c757aa1201c452f9f40f95198203c3961a67e9dc4e8d5b12534c7bb60f09a22cf4a68d38c658ccc8412", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689752477, "uuid": "ac0ad3fa-ba0f-4a5d-be5a-f37aaa849a63", "value": "T1BB066BE0B240F400F7039D37A08A0991DA653CE3BE62FDF67E57B72827386E54949697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689752477, "uuid": "367d972e-dd3b-4b34-b940-1f5cf19fb4d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689752477, "uuid": "64ce90f0-7707-44ad-a2c7-616d1cfc0d1e", "value": "49152:YmVk0nI09LPR5a0RwSbnrQfE0ULQCP90uiAvfyRXeYEOoXQhEArxfPK:YmBI09L7NNKMP90ui9OfOoARk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689752477, "uuid": "95a19cb4-bcfd-4c33-aa6f-e8ecf5b29c68", "value": 3789504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689752477, "uuid": "104b5f1a-f80c-459a-a2f3-09392ba32d0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689752477, "uuid": "950b3fa4-db85-47ef-b955-d38f2e61f057", "value": "0395d6d44bdd51dab4a38ba16f7625fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5fe47f3-25f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1689745687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689745687, "uuid": "c1d479fa-aa12-461f-a33c-8e9b08dd6a00", "comment": "Malware payload (Formbook)", "value": "7463bcd197e00d407948195d41ea4fae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689745687, "uuid": "2c9e917e-86b2-4bd1-8a28-8ac406f8d628", "comment": "Malware payload (Formbook)", "value": "38075dd02de75f8f9deb963a0444d3ad0c7747c9f6921766ff5c545ad4d0a88d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689745687, "uuid": "aba6f750-cbcc-47e5-9a9b-7a989dce71f2", "comment": "Malware payload (Formbook)", "value": "7a6efc41108f9fc85e2c0b0da29051a1a5235557", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689745687, "uuid": "47ac3ce2-4b35-4c56-b7eb-72a43ae1732f", "comment": "Malware payload (Formbook)", "value": "e1bdba21d87cbae7aab3ec710f10d63ef8f8f4a9737c0ccc18df5873c11e9531328ad5dc100f762daa41ff4ecc65593b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689745687, "uuid": "b3a545c0-f059-40a4-aa80-ca33cbbc79af", "value": "T17C5412483664C5DBDC765D701BF9178BAEF0A9122064068E2724275CFFBA293DA1E3E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689745687, "uuid": "d759637f-5124-48d7-9667-8b762710d39e", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689745687, "uuid": "6be92f4f-170a-498e-8d6a-7df422f1b2f8", "value": "6144:PYa6KHaOyhESZ0BIndDRqLcqpTxZHwm3Cf/riJFcH5SMNwhl:PYsHaOnIF3EPYziJFZMGD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689745687, "uuid": "8c03e602-38ea-45a7-99e6-5d64be557007", "value": 279210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689745687, "uuid": "ecbc12f6-61df-4028-b202-1b8847d4e48a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689745687, "uuid": "991b6380-6145-4ec6-bcbd-4728ed0a55ff", "value": "payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70c06aa9-25fb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689747235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747235, "uuid": "c089a612-ce47-45c1-bdb2-024dbd8baef6", "comment": "Malware payload (Mirai)", "value": "6cdc66c3685315795e67f9478c2de33a", "object_relation": "md5", "Tag": [ { "name": "2-59-255-213", "colour": "#A4F8B9", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747235, "uuid": "fab0caa1-0f8a-49b0-87bc-3c0e0aa635ff", "comment": "Malware payload (Mirai)", "value": "3862e59c7f62daf91010ae17c9729abd936d414b24b384541c055b5918682930", "object_relation": "sha256", "Tag": [ { "name": "2-59-255-213", "colour": "#A4F8B9", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747235, "uuid": "474c2f66-08ef-49e7-9a41-8212edc6f5de", "comment": "Malware payload (Mirai)", "value": "484784f6f49abbebef4c4dc8b75ab29fb29cca4a", "object_relation": "sha1", "Tag": [ { "name": "2-59-255-213", "colour": "#A4F8B9", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747235, "uuid": "2980fd3a-c538-4aec-ab2f-d652efc00f24", "comment": "Malware payload (Mirai)", "value": "6f674c2e648dc958688c4ddfc7c1f7d239b40401c12f3fa33a8133e41a2b2d71bed785898223ae37d5f0fc4f22330b30", "object_relation": "sha3-384", "Tag": [ { "name": "2-59-255-213", "colour": "#A4F8B9", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747235, "uuid": "4df4912b-1446-4501-ab21-93444af2b6e2", "value": "T1E3D2E130716B5C31C6228937FE69E90203E73FB0E2D0627B75D962647542D2A98B73D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747235, "uuid": "43d3117d-eb7c-423c-8960-5eaf99ef85e2", "value": "384:hn85oqYzx5mAUpHCUrWWdSSSrVIafp68OdrJAJ8H9ZpBnp79aRqqhymdGUop5hQ:x8A2ACH96PFrVIafUc8H9ZpBEs3UozW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689747235, "uuid": "36239191-c570-40fc-bcde-571cb1f73a8d", "value": 28544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689747235, "uuid": "a2e19a61-4ea4-4695-8f5e-f128357ce86d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747235, "uuid": "c42c05e7-1c03-4526-baef-c3e3c84fecf0", "value": "Namz.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fa6db8d-2605-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689751394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689751394, "uuid": "187942ab-da8d-4ffb-9115-b44839eeebd5", "comment": "Malware payload (AgentTesla)", "value": "15e810b0da374ca519bfaaccb7a9e460", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689751394, "uuid": "9021fcf5-edc5-4ed8-9ff4-ea7f3e9a18ce", "comment": "Malware payload (AgentTesla)", "value": "38a82a5e6d18531669a13e2d8b964eca5322e519e59b0267e6e23be4cc3ba67f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689751394, "uuid": "ef510c40-bcfd-4bf2-afe8-552e30b7455f", "comment": "Malware payload (AgentTesla)", "value": "ffa7ea07d47eb69743a4a4da45230110bd933546", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689751394, "uuid": "450853e7-77d6-4c4a-b7fb-11b0c7e2ade9", "comment": "Malware payload (AgentTesla)", "value": "cb093fd3ffbfe15330f5f612c5e27fa988b24d795b84fc011c5d5e557f4c47e4a95dcec2bebe046a1a2424bfe82d0821", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689751394, "uuid": "ba05a4e4-7028-48e2-bfba-cca1f30731e6", "value": "T135D4D0503B6EDF21CB99437A521683E473380D09B24DED2836C2768C14FB6E2D257ADB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689751394, "uuid": "ebbbf359-ed42-4225-88b4-f40e28ace685", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689751394, "uuid": "67a1d3ef-df63-44b2-8da2-dcb83edf834a", "value": "12288:uf1gIKy4laA5c0lD1fyRaO2NjwtE7kpq:u9gU8D1fyl2NmEIpq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689751394, "uuid": "cb3c3439-1e55-46cd-bc1c-4c782ec1645e", "value": 646144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689751394, "uuid": "ccb77c6a-e250-49ad-bc7b-7d2df0774c49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689751394, "uuid": "51f5b068-0150-40b6-8a37-f7669b8cce82", "value": "IMG_Scan PO-EPDAs & comp POs, PSB-17398902, PSB-18384789.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61a2c30b-25fd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (STRRAT)", "timestamp": 1689748069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748069, "uuid": "b9dfb509-b320-4d31-9757-b975917b9bba", "comment": "Malware payload (STRRAT)", "value": "c1b3a66708b0dc8fa13aaea724032e58", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748069, "uuid": "8b23accf-f40f-4b1e-833e-058b0c293d55", "comment": "Malware payload (STRRAT)", "value": "38f16716c69e578f1300e63047e290bcc2ec6ac7e9fb984ffa2139ee4f0dfd96", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748069, "uuid": "2012175f-ce6b-48b5-8500-c0f09952c441", "comment": "Malware payload (STRRAT)", "value": "c5977c742045fc64a263d823488ed9b38bb71076", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748069, "uuid": "3ca3219f-8c38-489f-a6e1-f520b5507489", "comment": "Malware payload (STRRAT)", "value": "818ea86dbd6700a3c1449f3d463161b63dcddc19bc2694f52e57baceeed53250231e99d0a5024753de31f214d55b4e23", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748069, "uuid": "cd9cf331-fa23-4ca8-963d-13dd91e74912", "value": "T1296302732E78C59CD647B43429064503BC3C04F6F2B6041319B9883A557EEBBA7476EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748069, "uuid": "8b0cf6c4-13db-4c0d-abe1-23c2e366dec1", "value": "1536:qSWTftBgotLJx0zsZFDyH+c/lcyVhEKcygsyYRUsLr2P35khV:9WTftBZRJ2zQUHPCWhks32P3QV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689748069, "uuid": "f7d211fd-0777-4ae0-9730-dbd7a6063a00", "value": 72336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689748069, "uuid": "f6947760-9eec-4397-a432-ec935f1ceba1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748069, "uuid": "068dbcf7-3b99-47eb-b34d-4d2f45c2f674", "value": "SatrapTrades-Offer-Request.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b481035-2633-11ee-a6f9-42010a9c0055", "comment": "Malware payload (STRRAT)", "timestamp": 1689771170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771170, "uuid": "2c230246-6826-4cba-9fbf-32b7415a336e", "comment": "Malware payload (STRRAT)", "value": "d511423320c5ecda84b3ad4593226995", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771170, "uuid": "3a204a5a-6b05-4108-b3c3-67611e403bc1", "comment": "Malware payload (STRRAT)", "value": "38f9a8011711457c86a993ee3478a3bed9108c77a9ded197049f817f18c1a576", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771170, "uuid": "e187742e-419b-4ca9-89d6-14ad7f39b79c", "comment": "Malware payload (STRRAT)", "value": "d9f47888492ccfb6e53645aab098e82382fd3d4e", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771170, "uuid": "142e8967-f9b6-43e1-9bc1-e7feadc0fdb4", "comment": "Malware payload (STRRAT)", "value": "a2deb1aae819e19d1298f9660922c41ae8045fd1f8911032e13b0b1419eeb89d209763735029324e038be1035bd309c2", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771170, "uuid": "f11e678b-5f04-437b-b9ee-6e9d40b4e379", "value": "T14F5401EF3DAAC0EEC00B61765700E677681D06C6C099E12B25FC39761938D6A1E16EDF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771170, "uuid": "6db05785-6943-439b-a089-4842b7460408", "value": "6144:ydfBwx+ADc1UnrIaVJnV0sZBltOz1hPkoVsdVhacijUi:oAQ1Un8aVVV06BCzLZydV7gx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689771170, "uuid": "8f628956-a73a-45fb-97e0-872b50fd45c5", "value": 281012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689771170, "uuid": "6aecb383-6738-4edb-8c40-60a6eb8e603f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771170, "uuid": "4c0e245f-744b-4b7e-95bb-d6acb5e07b30", "value": "ORDER-230719.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d101888-262b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1689767898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689767898, "uuid": "a57db015-8620-4195-a76d-d07497bc1ead", "comment": "Malware payload (DarkCloud)", "value": "95e7e6d6c22760ceded6dae93e09e2da", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689767898, "uuid": "a9e457f0-165d-409d-b083-38bdaa504302", "comment": "Malware payload (DarkCloud)", "value": "39c3188d01340e7dde2d297ac10dca13ec5fb3299ac57c2259dd81007660206f", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689767898, "uuid": "65fb4c99-b8b8-436e-9606-47d62a80b190", "comment": "Malware payload (DarkCloud)", "value": "59aa6178468103a0231168ca90ddfb7f6b478b1e", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689767898, "uuid": "793e5385-ecbe-4545-8403-7976c361b437", "comment": "Malware payload (DarkCloud)", "value": "db384c8f4fb887a238f10443b9595dbdc52b2b790340edcac57dfe37067128026524920f57037f726ca0c9430403f508", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689767898, "uuid": "e21aa461-9eed-46d5-9238-936f2960cbd0", "value": "T16615121039A88B23C2A48BF552646B0153B59FDE34B1F15DAFEBECDB71A1F101A50E17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689767898, "uuid": "dac51bfa-7761-4bd8-8e7e-063e3cbe276c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689767898, "uuid": "b01e8336-930d-4f7c-bbc2-b1f6c964737c", "value": "24576:XPYPgIQBIE16I7wTuWm1qv0AW5zdEN87GuWj:XwxQBvMI7wTZuqv0RldENGGuW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689767898, "uuid": "165ba14e-3e1e-440a-a14f-5a1d1bb12daa", "value": 881664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689767898, "uuid": "f2146550-000d-4b90-8068-5f43e4b40ec3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689767898, "uuid": "4cd64188-f9dd-4484-ade5-b61a14fd1690", "value": "Remittance Slip -4,324.62 C42237.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5db06c21-2687-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689807332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689807332, "uuid": "1852ab1a-171e-4e14-93cd-8e6bcd21851c", "comment": "Malware payload", "value": "6d7582c2d25568ab395bb7976055eec5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689807332, "uuid": "de68a845-c0a1-49fb-896f-2bcd20c810f7", "comment": "Malware payload", "value": "3ab53331c1c7719a8dfddae29ca7e6a1cfb8965f5f45fc0f89801050523fb825", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689807332, "uuid": "a7f6504e-0f10-45bf-a9fb-ff4a3b59417d", "comment": "Malware payload", "value": "26fa9f417f885e9f58b16c9ce177ae0f6d92cc01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689807332, "uuid": "687a8a51-c4c0-48d6-b490-18d139614546", "comment": "Malware payload", "value": "bb1a06c255ea047c89d8771e8d9f6ea2e3f4385525a2a7d1a1415062e7193df69c02faaba3ce93e8f70ff07e7ab70244", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689807332, "uuid": "506001a9-108f-45a1-b3a1-f6a080111254", "value": "T12F44CF217691C073E4676A301531CAA16A7BBCB2EF7281CB33543A3E6D703C15A79767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689807332, "uuid": "5519d38e-c4d1-458c-b5a2-a855f1b4ee0c", "value": "02f23a44e70611470e4c2107da6d7f64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689807332, "uuid": "663b015c-f614-494d-ac02-836be5b3b929", "value": "3072:wV3gmXlQdCzvE/x0CH5+hzlNCP6HTihtSaforlH/Cw13:4g6Q8zvE/TH4BOuw+r1/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689807332, "uuid": "99b2aa41-e5b8-4cba-91c4-f591784ca0d6", "value": 262144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689807332, "uuid": "9ebae57e-22fe-482a-9870-987ffb00a9f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689807332, "uuid": "03b0eddc-0913-4d6d-99ca-40da4b7ab3ef", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40784b34-25fb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689747154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747154, "uuid": "5d1e4b50-b6a7-420e-83b4-b8d42de4b534", "comment": "Malware payload (Mirai)", "value": "e52e546903b99554b0401da811cc1b7b", "object_relation": "md5", "Tag": [ { "name": "2-59-255-213", "colour": "#A4F8B9", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747154, "uuid": "2ee48266-3f3c-41a1-aff7-bc4f1b86ecf0", "comment": "Malware payload (Mirai)", "value": "3b8782a1949231b44570feb5461104fc64e2a98a715560528cdab74c9edf7cfc", "object_relation": "sha256", "Tag": [ { "name": "2-59-255-213", "colour": "#A4F8B9", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747154, "uuid": "9cfff022-2896-4fbe-b905-323c2149a40e", "comment": "Malware payload (Mirai)", "value": "48a984260b8f62c0b2a5c5e2f66c6789f797ade9", "object_relation": "sha1", "Tag": [ { "name": "2-59-255-213", "colour": "#A4F8B9", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747154, "uuid": "795f991b-cde6-4b9a-befa-2e8d3c1ce7b3", "comment": "Malware payload (Mirai)", "value": "3dbea205ff7b468d7f798085572196e4aa5654cc1d9c07aad90df6f77722857cbd89cc3988f52b8ea04b07ef604b2454", "object_relation": "sha3-384", "Tag": [ { "name": "2-59-255-213", "colour": "#A4F8B9", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747154, "uuid": "16f73917-179d-4974-bf9d-cde5da59dd0d", "value": "T14A735B24AD3D2E22C0D4A53A52FB8325F2E6230E25B4965D7C760F9FFF2464468572B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747154, "uuid": "2ac1a8a2-10a2-43d4-8434-4d20992aa844", "value": "1536:q+kyDSBJ6OmiDKFZ7MOYonGmcFc95kwAvy1U4YUgF1Av:q/RaOyiuGNFc4Tvya4HC1Av", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689747154, "uuid": "363ad475-25c5-4aae-8bd1-b515b2426bf3", "value": 75128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689747154, "uuid": "52933f30-9f5e-43a9-9b2e-165944f92e5b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747154, "uuid": "477d7381-9e71-45b4-8f1d-684abdc84ed7", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6226cc6b-2618-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689759666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689759666, "uuid": "85e1d50c-f4ff-4a7b-baa0-8743332f8735", "comment": "Malware payload (AgentTesla)", "value": "8e1367adca7113803afe06e6543694cd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689759666, "uuid": "e7064185-973f-4e34-965b-3aa439fc61f0", "comment": "Malware payload (AgentTesla)", "value": "3c1294b9a29a8aa83661ea11324a56c101a318bed5b49f6e47ec24c535330bfb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689759666, "uuid": "c0b35813-cb7c-46c6-b2be-31aac805ad9a", "comment": "Malware payload (AgentTesla)", "value": "7171f5ab8cf0c2f60001029b63d06fbc2af40583", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689759666, "uuid": "26b7ca9f-0bdf-4ba0-b7ae-41bdea24ffae", "comment": "Malware payload (AgentTesla)", "value": "e3a28076cdfe986129310202c784ae67d34cf744a15de0925939242be229cbcabc70bf5a9ac75f8a67cfc1e96cfa2116", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689759666, "uuid": "353fa9ca-45d5-494c-8209-b7664fda4b43", "value": "T18903CF0407EC0271D6660BB8DCF202421B796FA7F566DF9FAECC664E1C033291722AE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689759666, "uuid": "ff8dab16-139b-41f3-95f5-b2aacb9c2832", "value": "768:olnPlW8e4j+E3M2F7Tllmu24Ra2DovIieNhIPVQPavQ5:+AY+Z2JTll92m7ov0oWMQ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689759666, "uuid": "fbd4a472-5349-492e-88a4-b4b8166e5234", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689759666, "uuid": "90618fe6-5ddc-41c8-85a8-fb8436cb5674", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689759666, "uuid": "6b2c0838-479b-48eb-bcd9-b960d3695a0a", "value": "SWIFT BANK COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec8bdf5c-2632-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689771065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771065, "uuid": "e2f0b470-9845-4ff9-99e8-03ecd5828564", "comment": "Malware payload", "value": "2891b742d6d04d77ed07e50d9b75f57d", "object_relation": "md5", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771065, "uuid": "9224a152-7be6-449e-a326-481288ceb837", "comment": "Malware payload", "value": "3c5676b6bb2f4e3540dea95eeb51a3f3e208f18e851b71b03ce7cb942408fde8", "object_relation": "sha256", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771065, "uuid": "b524623a-a24d-4746-9953-0f354f61eec3", "comment": "Malware payload", "value": "5a924c39b41acba05658f957554acfb8268a368e", "object_relation": "sha1", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771065, "uuid": "f7c4d973-a6fb-4b6c-bc62-3aa21d225154", "comment": "Malware payload", "value": "678624e6c7e206b90081f06a95c1fbffcc936b7f31a81b78b05f096784b101b65c3a9c3807213ddd067c5490889dd1f2", "object_relation": "sha3-384", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771065, "uuid": "a463410d-37b5-4f63-b51e-c1634519b392", "value": "T1FD341DA4644F0876E208EC5D65D47245AE76FEE330C598B123AFE031CF55AF2AEC458B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771065, "uuid": "039cc42e-de35-484e-9e29-1f8904bd390a", "value": "1536:i8QysElWgY5z0z0rLZeEcXOQlFmeDU+o+CUyISUPQVzFz76mAg5eeVhMDw5wfLj:ir5duaVzFtr5RDAw5wf/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689771065, "uuid": "58ced8d1-1d35-4edd-a8e3-9aba840cf0b4", "value": 238260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689771065, "uuid": "0254620f-94cb-4565-9467-fcd1837a1b04", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771065, "uuid": "e1e87b66-f999-4adf-a172-43cbe16eb05b", "value": "Catalogue.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "135ad98f-25f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Joker)", "timestamp": 1689745360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689745360, "uuid": "117423a7-15e3-4495-ba05-c61d3e3717aa", "comment": "Malware payload (Joker)", "value": "c49f0aee218a72e7c3ec739b289cdfc1", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689745360, "uuid": "4ef55b9f-7920-46f5-8699-a8f64382c113", "comment": "Malware payload (Joker)", "value": "3c7eec55d83a346b4f5f3f25dd9a56f5504a404f165db3fe4cb9717c7a166886", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689745360, "uuid": "5c312fe2-3dc8-4f00-a314-979d3f0048f2", "comment": "Malware payload (Joker)", "value": "affc5b85e9f4207e3fc7b9f4e0efc673036a80bc", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689745360, "uuid": "ec545497-6df3-4cf0-86dd-ff7483867f8f", "comment": "Malware payload (Joker)", "value": "ef9fe45e44b519b68f5cfb987e4e401f4dc7c2f31b2155c29ef0d62d7d3de2fb6a1d1075f8bf1abc101ba603963391ef", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689745360, "uuid": "76ced563-b256-4f78-8a57-265c118cc4b2", "value": "T1C656F0D7F7A8A92EC87350F68D6E5B72014B4C128A839B536D14730C68B7AD46F49FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689745360, "uuid": "d622fd83-cbf4-4d3f-a298-8a4635ba66f9", "value": "98304:IL5PZO+uOdbQ2mTGtdlhygelQSDUvIe/EFYiztk9sY+r8htKvfDEGgQA5grh2Zr4:6QzkVmTGlZSYQe/YJ2WYO8hkvfDEGgQp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689745360, "uuid": "0aaf1e66-0735-4b59-be4f-8faec84a432a", "value": 5967460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689745360, "uuid": "7ee5f329-8d7a-49ce-ab0d-0e2c399801aa", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689745360, "uuid": "efcaf404-843e-4a07-9dfb-ab535e8f3a21", "value": "4K HD Wallpaper_3.8.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4f09fc9-2668-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1689794164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689794164, "uuid": "757a73d6-d302-4ef2-9f2c-e029c7afea3b", "comment": "Malware payload (njrat)", "value": "1d1e55d56501a4c020359838798b5e9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689794164, "uuid": "e1834de2-2e73-400f-bf78-fec2accf7c2b", "comment": "Malware payload (njrat)", "value": "3c8ae458a96eb7500d2c065c8232645ba3961e981bfaa1e4cbaf6f5d5558ee64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689794164, "uuid": "55d11b5c-65f2-44f7-9b93-71417085051c", "comment": "Malware payload (njrat)", "value": "049e20770fd71194141c2c0debdfafd317c56ca4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689794164, "uuid": "6411abd0-00a3-4e1c-b34e-463a0ab312c1", "comment": "Malware payload (njrat)", "value": "7787e71c8af0cc2b8ee2ece472c2ed2948356cab67dba6f6b8c1793ff281ca17a8fa6156c6972a2991e96571f52d8a5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689794164, "uuid": "aeb0b91e-f3b9-46ab-90a3-dfefe17b7aaa", "value": "T1A8249A0EAFECF0FED38BC77219EAEBB6B0121C254D26050655502F2EBB30781755667A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689794164, "uuid": "6622183d-f704-4dc3-b272-b0476aca2763", "value": "67814fc50fc21633690e8019e09509fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689794164, "uuid": "1ab610dc-8fb4-4c77-9d41-8e37e5ddd2fd", "value": "384:3DVUq67iFRNItImlQN2l0hj4draNwzDHIOu3nrd7DjdYt8Gn5u5nh7uTht1XKvj4:3pUZ7iFfuITgHwNet8Q5Z6vmp+v2o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689794164, "uuid": "0338d805-9b36-4ae2-a8f6-501382e3a4a7", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689794164, "uuid": "ca398ea8-1212-42aa-9bd2-0db05437318d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689794164, "uuid": "e1c3356c-c40c-45f0-9ff8-aae1d4c6c005", "value": "1d1e55d56501a4c020359838798b5e9c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de40f04b-2615-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1689758586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689758586, "uuid": "7ddea977-8138-4a8c-947e-60211b6110f0", "comment": "Malware payload (Formbook)", "value": "77c650881201dfa0953408f57811e3d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689758586, "uuid": "9b859871-d398-44f2-999a-798b9ad898a4", "comment": "Malware payload (Formbook)", "value": "3d4ea786fed7c7557db3d0be1333b26ddba5b33ec6f2db706e8db831b1e89167", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689758586, "uuid": "34da1764-5ef0-4a8e-8dc0-fa92df702651", "comment": "Malware payload (Formbook)", "value": "a4aa6b39205e6668c66b6233c9ee3377553edd19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689758586, "uuid": "18858445-0a82-48bc-899e-31495f74f159", "comment": "Malware payload (Formbook)", "value": "e3cde3028c11bc707e1178fe85fdb41eb63e4e26647f5443e600a8b4dc31b222448300adf1356388c9ee8d0a26470cf4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689758586, "uuid": "81170d79-7015-4156-8f4d-9eac64f7642f", "value": "T144E402C2F299A60FF0EE07BB6B604A5053B42E822553E50A5F967FC97E273014794F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689758586, "uuid": "462860d7-da4b-4125-a598-c9e837881ed5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689758586, "uuid": "f5a2ebac-2b96-471a-afd4-635cf238aa22", "value": "12288:APYPfY7yA9CTmd/eAOfxzmqYbavx7U7UqyxKS1k:APYPgxd/fQx1YGvx7U7UGS1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689758586, "uuid": "24da14ba-0e50-4f88-87cf-c8a79b679120", "value": 692224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689758586, "uuid": "cc3e860d-0911-4242-8cf1-2875cb6be7e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689758586, "uuid": "2d20fdcd-8087-44b5-bb39-fe9d2b3d160c", "value": "Request for Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd630d2c-2637-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689773133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689773133, "uuid": "da1f1c7e-ae6a-45a5-817a-e85a61fdb770", "comment": "Malware payload (RedLineStealer)", "value": "00b20738f1719e9d165b996cedf1cc3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689773133, "uuid": "d1101c08-b63c-426c-864d-4a5ab95559b7", "comment": "Malware payload (RedLineStealer)", "value": "3d5d854d7b4667609b1a4eb70e50a6f99578a6ede0809793fc835cf2aebd7221", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689773133, "uuid": "f49e05fc-08f2-4fc7-816a-56b9d3e53769", "comment": "Malware payload (RedLineStealer)", "value": "8f8973a6b71a499743c2df566f594f696aad169c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689773133, "uuid": "51bed95e-543b-419b-9699-a88f27fdc1ab", "comment": "Malware payload (RedLineStealer)", "value": "8626317c90b54ac9f8d82bd924c1ef706d35c5bbf89d5f82a935136f5d0ff4666615b0a8b2d90cf88fb0bad7d45d4110", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689773133, "uuid": "00cfff77-3ec9-436b-b070-e40228eb592a", "value": "T11A840113ABE89073D8F517B108F742930A36BE616D7843AB3751985F1CB36D0A871B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689773133, "uuid": "9bd50eda-c665-4fdf-ad72-66ae822b319b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689773133, "uuid": "5eaf1375-eb5b-4a33-9b22-fc0b77da6150", "value": "12288:pMrHy901thF5SPk+/GQICWr6/hnlD9x6T:GyCXrQIaZnwT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689773133, "uuid": "d8c72c35-0a30-4c43-b44b-8691a3917cf9", "value": 398336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689773133, "uuid": "b31506b7-6753-4994-a24a-e7cbc6fa1cae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689773133, "uuid": "17cd7448-0eb3-4fbd-90fe-c7507742fb3b", "value": "00b20738f1719e9d165b996cedf1cc3d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18b87be1-2685-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689806358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689806358, "uuid": "d28c9572-a387-4c5d-85d0-633bbdb49935", "comment": "Malware payload", "value": "30f655b863ffb73cc44a54b2826ec4f3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689806358, "uuid": "0bfbc5d5-8aa3-4e18-9f87-8dd9b698a135", "comment": "Malware payload", "value": "3e5096359da3ff9944a9b85da8a000648c32e77d898b8966b242a332d8b30b1e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689806358, "uuid": "d10f813f-cfad-4766-ac4f-cf5cc1cb1cf3", "comment": "Malware payload", "value": "4dcf1813aa8abbb2e4de3f3e25ed3cd03fa5429c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689806358, "uuid": "31a9a58a-bdbb-4f26-b411-149b459b943a", "comment": "Malware payload", "value": "34d89ed7a51c207df181881c91d5935f2af6f3870e4868ad8b909f14d6ea2ce6adbc1437c92bcd124f36c4c54af6fcfc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689806358, "uuid": "f4775ddf-d00d-4617-879b-a01b4fb3a9f7", "value": "T17CD5E7D2B650F800EA63A933A7860964EB427CE6BF13EEF63C47B71627366945C10357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689806358, "uuid": "0fbb7212-1586-4b10-b3b8-51cdaaf3212c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689806358, "uuid": "aadcef75-c700-46c4-8637-d5945e1f911c", "value": "49152:KXp9NFVec0G3BQLnyGSxb2QxT57dYMK4TgOJ5:KXpYePpRKzo5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689806358, "uuid": "3897e7da-b720-455c-a818-86e334cde7b9", "value": 2970272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689806358, "uuid": "97fcb2d3-b44b-403c-b636-e8141d2b05df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689806358, "uuid": "0732b532-0e46-4182-8f76-5b53295bb171", "value": "30f655b863ffb73cc44a54b2826ec4f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34721b5f-265e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689789654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689789654, "uuid": "92cbf6b5-4df1-4982-b982-c186ffde609c", "comment": "Malware payload (RedLineStealer)", "value": "4235dcbbe7ca647077330dc52f980d24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689789654, "uuid": "7ac56733-5f05-4768-85b6-d7abac09261a", "comment": "Malware payload (RedLineStealer)", "value": "3e8f48efac517820b33ca980ac803d33574511d1c094ad730fac2048d9198843", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689789654, "uuid": "d206353a-5ee1-457c-976f-8e3860510ea3", "comment": "Malware payload (RedLineStealer)", "value": "a0a22e91ce971ed8d1bfd4769094dfbc6272395c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689789654, "uuid": "953829ed-0cca-499b-830f-912dcc2ee87d", "comment": "Malware payload (RedLineStealer)", "value": "a3f14febbf3c5eb71b2eda502e53e253da709989866341525d87185c19dc47345c008bd4a495841232a0d9984f54d9d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689789654, "uuid": "be13e89d-868e-4fb7-ae58-7a877cf4ab07", "value": "T160E2F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689789654, "uuid": "73763191-483b-45b9-a4d9-5538006db8bb", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689789654, "uuid": "dcb39961-33fb-47f1-b282-270f37780b15", "value": 31141, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689789654, "uuid": "7e22feb0-78d5-4ddf-8cc1-883b81d69ab7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689789654, "uuid": "a4fa75ef-7ffc-460f-8c81-3b3bec9b1ac1", "value": "4235dcbbe7ca647077330dc52f980d24.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74d7980c-2681-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689804794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689804794, "uuid": "780b73f6-eb27-4377-bee4-f45bfcb71307", "comment": "Malware payload", "value": "fb85b4100eef2959e1ef86fa3be686f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689804794, "uuid": "5bfe4b00-bb13-4d5b-903a-11d8463a50bb", "comment": "Malware payload", "value": "3f73ddf43bef7f72423397a3a7d469d3bd4c3b84f7ffa7ee0fbdbed16bbe204c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689804794, "uuid": "a56c0800-cdc4-4d8c-a84f-383ea2cdb7d9", "comment": "Malware payload", "value": "0035bb53c437d3e821c5010402ce7dca03de068b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689804794, "uuid": "68ea9ff0-e090-4f27-8b2c-9493354b5eb0", "comment": "Malware payload", "value": "373784e8dc945e3e4d83db9d9f563d0d377ddc5b7cae75bb5f3a6581fccb99f4db92fa8df29b91c2266f2b5bbd89d533", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689804794, "uuid": "0b7179ea-17ad-404b-93b0-d83fa26090f1", "value": "T1B303C00407BC4271DA67077DDCE203821B3A5F67E86BDF5FAECC968E1D4332916226A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689804794, "uuid": "eb7d9607-a2a1-4f15-b10d-2696f53cf249", "value": "768:VlnkNhgIGhb0+kl3M2F7Tllmu24Ra2DovIieNhIPVQPamq+:YhvGhA+B2JTll92m7ov0oWJq+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689804794, "uuid": "fab153c9-b193-48cc-b793-490e85e4608d", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689804794, "uuid": "bca0b110-8a5b-4d81-ad33-fafe4e2111d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689804794, "uuid": "bcce3252-47d5-4bd9-a357-2b52bb839d15", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b6476b7-265c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689788753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689788753, "uuid": "d3a981bc-d480-489f-a0d8-4e817c67fdb4", "comment": "Malware payload (RedLineStealer)", "value": "975221a9e5d1d9ff0a73785a0b77db87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689788753, "uuid": "fb71eea4-f5af-4c4e-a31e-e885f41e41a7", "comment": "Malware payload (RedLineStealer)", "value": "3f7cb4ab9fec77b855a82a5088c84e13f7217970f0e36c3a776cd4917748b12a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689788753, "uuid": "4a2f6fed-80d7-43b5-8565-53574d843ce0", "comment": "Malware payload (RedLineStealer)", "value": "11210afdd37a2d424bf938886feaf26e5c8f130e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689788753, "uuid": "b7055f47-b132-40ea-b07c-7c95105aaa0e", "comment": "Malware payload (RedLineStealer)", "value": "ea73c83951306a92391792477d60938df5413cb16593373cf6222a0693eab28c6e7b9c06a4ed08bbe10b12cf5c0d96dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689788753, "uuid": "12743268-53dd-4688-86e1-8b819a71bd37", "value": "T196840253E3EC8032D9B527B06DF702C31A36BC919978877B2746A55A1CB3780A93177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689788753, "uuid": "34d07020-7b58-4acc-b70b-415b8c0455c4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689788753, "uuid": "c193edcc-d33f-4b58-b9c2-531e5cb77761", "value": "6144:KKy+bnr+ap0yN90QEF2mD9hlv+EYLth+6C/RagwIPk8Wuqm06S7+QKF:yMray90hDlFYLeOgLkthm06qZm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689788753, "uuid": "38e64995-997f-4efc-bb72-ee923f8685aa", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689788753, "uuid": "41b325dc-99d2-4f22-9093-dccf08144cb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689788753, "uuid": "eb726fa5-648d-48c9-9343-d7d62476919b", "value": "975221a9e5d1d9ff0a73785a0b77db87.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9da550a-260a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689753880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689753880, "uuid": "28140645-2a25-4a76-aff3-3db1aa02b8c8", "comment": "Malware payload (AgentTesla)", "value": "fe07eeff85261a9e23cfff54c6f3473e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689753880, "uuid": "f9464f63-f76d-428c-99f6-f0d763ccb663", "comment": "Malware payload (AgentTesla)", "value": "3f94f8beb67786d2c22f9db56a81aa1bfe29e34bd7c52db6cfe71e57d688a0fb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689753880, "uuid": "35cdec35-101c-46aa-b87b-0f1a47904d21", "comment": "Malware payload (AgentTesla)", "value": "7ec350144270353463a0e6fcb858c3601848e994", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689753880, "uuid": "336d1768-2ea7-4b57-a7a4-9fa6cd8e18f6", "comment": "Malware payload (AgentTesla)", "value": "28443d1163ee0b2433ec34efdba9daad0ce9c6438427f18092e9b6d57effc4a5128df46733a081d037670e1eef455ac6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689753880, "uuid": "9c4e75d3-17d4-43e6-a350-44ff4c79c7ec", "value": "T13615AEC09148A8D6D1972BB06C36AE71062EBFF92220D5083E077F67B573F56265AC4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689753880, "uuid": "4e81e852-189e-429f-b420-a26ab21a7440", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689753880, "uuid": "45b1d013-5fc5-4700-b7bb-ee30c9d3ba5b", "value": "12288:hPYPfY7uMNc9H2XEBhYIITQjylWCbDCmDv7Y3oqJiF7LXGa:hPYPgSMqx2XkeIIT6sDv7IA7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689753880, "uuid": "147e7c89-20c7-4a1c-b40e-16904a01fc35", "value": 875008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689753880, "uuid": "9d07a103-6f11-4bba-9f51-cf529d3c0bdb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689753880, "uuid": "b2c7425f-8463-4c55-a63c-c272ebc19a17", "value": "PURCHASE-ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b626d7b0-262b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1689767967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689767967, "uuid": "495b3226-c63a-4d64-b21e-8a4b44aa1b0b", "comment": "Malware payload (Formbook)", "value": "dc3d6763e6d10851486bdda79e7f1236", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689767967, "uuid": "3b7d7ce6-bfb0-4176-b361-b0bdc6ad4dae", "comment": "Malware payload (Formbook)", "value": "3fa5e0f9bd75aad667883761285fe49486d136a3784b08c22fef8f32a4db19ab", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689767967, "uuid": "11de6861-5149-4139-80ad-e6d06dea8d58", "comment": "Malware payload (Formbook)", "value": "11058e1e97000d1295c868ef3a7a0d130c1e2b38", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689767967, "uuid": "b4ed1423-c2f4-4ab7-8754-026e39fe4299", "comment": "Malware payload (Formbook)", "value": "479e36cdf9b3c8b1851422c87d71c9a9f08b6ff6b1cacb2297038d1a200d4a632f81460be039b4e155ce83a300e21a51", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689767967, "uuid": "25869e74-e8b1-4adc-8624-b4c5461877d1", "value": "T1014423278F9A695827477BED71308322AC9B8B7C8F41D4873A9EF07BE57004BD0590B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689767967, "uuid": "9d8bc02d-ee16-4b5c-95f3-f7b448ef11ec", "value": "6144:uvbdv9D+tKQCq5qA6cs72FqYmOVoJ+K3y2efE:uv/+QVq5xs72QdEwl34E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689767967, "uuid": "dada3477-8538-4373-9aab-758ff0600dd2", "value": 263906, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689767967, "uuid": "c5a43683-21d0-439c-967a-68d6e5aa579d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689767967, "uuid": "366fd07d-3b29-4bef-bba5-d57eb1d792ff", "value": "Swift Copy.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eda7aae0-2632-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1689771067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771067, "uuid": "0cc2a5ee-a332-4dbe-8e95-50dd4c38d954", "comment": "Malware payload (Loki)", "value": "a4743d2d063536c3ecd49063e9b266e4", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771067, "uuid": "21893456-5d4b-4488-9eaf-2d667180e7cc", "comment": "Malware payload (Loki)", "value": "4084e0b4eaa3a33ac1f876edcdadadfafc1e1274507c752d3c99cd0c3a04772b", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771067, "uuid": "4532a12f-a8f0-4aa6-96da-735a30294797", "comment": "Malware payload (Loki)", "value": "b9d3995dc8f92ac21eb108f1c3629bacd78d9a61", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771067, "uuid": "056f4cbe-67b5-4f4b-9566-6a95458c9ef0", "comment": "Malware payload (Loki)", "value": "ba287cdc0549b4c6000500461364bc61b33f67b616f4712264d450867d8cbe4d297e354b7fa11efc56550d250e7bbdb4", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771067, "uuid": "faa79d97-32b2-410c-802a-40df57cacc27", "value": "T17E23B15DE38F02A48F911376135B0E89AABDB22EF350517134AC937433E9C3D4666ABC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771067, "uuid": "d0c37ddb-311c-4bdb-9dec-c345f5ca9838", "value": "768:gFx0XaIsnPRIa4fwJM3wSTJAvXfJPKJHM95sK40PFSzYnu36XQXssPp4LAKMHsV:gf0Xvx3EMgST+5YMjsKPPczYnuPsSUPf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689771067, "uuid": "2d7f939d-d48f-4487-a5bb-a9be18befbfc", "value": 46679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689771067, "uuid": "bbf34b23-8ecd-492c-acc9-f965808e2ca9", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771067, "uuid": "def27304-e107-404f-b9ff-5b4f049ddcb9", "value": "a4743d2d063536c3ecd49063e9b266e4.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63310e94-2602-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689750219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689750219, "uuid": "04733c87-fa5e-4bf0-98b9-0a348d937f4b", "comment": "Malware payload", "value": "88c208926354253140749f188f76b290", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "ticanews-com", "colour": "#FB8398", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689750219, "uuid": "0a4834a3-54ac-4122-82b8-8f4fcb163168", "comment": "Malware payload", "value": "420f37c2d25ed5a31f18c34b5a8c5ac8045e530200f947fb3ba930e506095a03", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "ticanews-com", "colour": "#FB8398", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689750219, "uuid": "d509e30f-01e1-451c-8ed6-5ebf9c58010b", "comment": "Malware payload", "value": "b88db7f1bc73b5372a70001f051ea55dbd2adc03", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "ticanews-com", "colour": "#FB8398", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689750219, "uuid": "f49023ec-68a0-41a5-a518-482b3b501ea5", "comment": "Malware payload", "value": "ea3b6819c25eb8cb15f226e7b94396fa68922f6d484b3f5951b4cc563bffb8c771e98c540812d00629cf3e4e28ff3836", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "ticanews-com", "colour": "#FB8398", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689750219, "uuid": "af3ce550-e339-4f62-a0bd-7cdcc36560ae", "value": "T122B4CE06ABE400E2D4B78274C4F29947FBB6F9505B3147DF172C469A0F63BD0AA39B25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689750219, "uuid": "52d2b53e-47f4-4a9d-bc6d-1c2c70bb9481", "value": "6144:2HnVW51le3cQbr8vHnVW52wl3XAKblEajNHakU96Cjle3cQbr8WlUwecboRRlUwW:2HVqHV6ALap/U9ToleRle", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689750219, "uuid": "a1b4d618-f1e4-4b78-b4c6-64375f3e74b0", "value": 503808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689750219, "uuid": "60b634be-f1ee-4a62-8b3a-7b18f054977e", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689750219, "uuid": "4fee4f40-275f-4d3e-ba8e-9c0c5352f3f0", "value": "420f37c2d25ed5a31f18c34b5a8c5ac8045e530200f947fb3ba930e506095a03.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "548bec0f-2632-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1689770810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689770810, "uuid": "d1e83afe-b73b-4c35-a261-21cf6cb7c8bd", "comment": "Malware payload (SnakeKeylogger)", "value": "eb2415e0582ff085664d4c66754738d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689770810, "uuid": "143f7388-b092-40f1-be41-81de8bff980d", "comment": "Malware payload (SnakeKeylogger)", "value": "4267e2d7fe9a8a024af4c37d0dfebe2b19475780ff5d503dc33aa5601d67444c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689770810, "uuid": "8437201d-2c53-4ddb-82a7-b557f439f3bc", "comment": "Malware payload (SnakeKeylogger)", "value": "2d651c548a52ad6cf247dba6ec03d0a86f872e7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689770810, "uuid": "d3897c74-e7f4-4b1a-bd3d-c58c27980b24", "comment": "Malware payload (SnakeKeylogger)", "value": "0829df3070643484944068889efef39befd9d89beb802a22b37bc2fc891e728ba6ab871155c4b423df7b7c9ba81db4f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689770810, "uuid": "197798af-2ca9-41af-883b-637819175b2d", "value": "T1B9D41240ABD8D65BC5BE57B81B70671093B8BF8AA012F54E4FD3ADE9347A7404A70B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689770810, "uuid": "262813fb-8be2-4cd1-8700-bcf495e6e921", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689770810, "uuid": "70fe5b7a-bc1f-418f-823d-46679942c4c1", "value": "12288:SPYPfY7NEtj8vTAIMbmhYdQZbptosQQqI+1XY:SPYPgqtQ7AVih0QZMIWI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689770810, "uuid": "0f9badf4-85a9-4dd6-9aa4-c9dd75f67315", "value": 607232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689770810, "uuid": "d8a4712e-358d-48dc-b6aa-ec4b224b75e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689770810, "uuid": "bdc9b711-9f55-4767-85bd-50a463a86338", "value": "Factura 2-000059.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9f79969-2665-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689792965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689792965, "uuid": "8a8ccdcf-8037-4349-b382-84a65e627b74", "comment": "Malware payload (Amadey)", "value": "cdcecd3749891f697a0af96762cb9124", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689792965, "uuid": "445867a5-84b7-47d6-8e07-0f158ddb9e98", "comment": "Malware payload (Amadey)", "value": "42aaf3452f3dbd3fec800b9307def7e1463e88016e6585d09719f8642ef8f491", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689792965, "uuid": "d25d5b80-93c4-4e98-b050-ecc491707f6c", "comment": "Malware payload (Amadey)", "value": "b31636aa34b1b3eeb7caefef82c37f2f093c6b64", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689792965, "uuid": "8ad41a46-ca16-498d-9c49-fe81f528bf58", "comment": "Malware payload (Amadey)", "value": "7d7b87babe36956abb3c57fb2f4f89d5140918cfff87d02f714ce239655daefdef915cd6907edac8ed971e759f2f6bde", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689792965, "uuid": "cb469cd4-62eb-4995-9eaf-101ba454efa8", "value": "T101840113FBE88172D87127F01DF703931A36BDB29E7483672795999B0872691A63133B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689792965, "uuid": "c48f584b-6384-451e-93b7-537182c0bbd4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689792965, "uuid": "84c69e66-48f8-48a6-bbc7-b495e686f4a5", "value": "6144:KOy+bnr+3p0yN90QEHP8pAkeKHGqQ4ewNu043Hvyj6qxNnUvDrqmPB:eMrny90himqQXWMHG6qX+rx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689792965, "uuid": "95dbda6f-75bd-4556-a88a-0705acbc4703", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689792965, "uuid": "283450d7-72cc-4453-b1b9-2073f8c3cc70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689792965, "uuid": "e25bf588-6741-4edd-80a7-59ae4327804b", "value": "cdcecd3749891f697a0af96762cb9124.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09be9959-25e5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Fabookie)", "timestamp": 1689737613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689737613, "uuid": "7b6c5a92-ea3d-487b-b63c-69e29c9d718b", "comment": "Malware payload (Fabookie)", "value": "92c4629358a520e41cc36eeb56af712d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689737613, "uuid": "4fbb7dd1-a39d-4697-9d81-9f3a01b27f6f", "comment": "Malware payload (Fabookie)", "value": "42acb4ebe6efba15eb0ed6d1c404335458cb4594493116edf2b0af257fd6e24e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689737613, "uuid": "717bf378-8961-4263-8e18-c031669e0668", "comment": "Malware payload (Fabookie)", "value": "8fecd46a0aa61c681e7a7f85a950633c85229474", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689737613, "uuid": "8b6bf25e-0c69-4da4-899b-c8ce0f960072", "comment": "Malware payload (Fabookie)", "value": "1b8606975d028d634fee90a89c407c1884e7522c6e2eb38df1140029c9fbe7dbe44a5c0aa4c0fcee745d9c6e31d4311c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689737613, "uuid": "6682f7b8-cb72-4b8d-b7e8-4ba02ae3183a", "value": "T160D4CF81B39095D9C4B88430C693CE71CA317C64DB28569BB6D4BB6F2F32AF1653731A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689737613, "uuid": "cc69712c-076b-4d28-8010-7928fb8cdcc5", "value": "4673ad56625d375f2efee239af061364", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689737613, "uuid": "d131f2ed-981d-42b8-a7c1-99d83e88a8e7", "value": "12288:y72LPfVjvyL8XM3lRkRc4YFwjsWAfRgantPbcTTn7axerx7:eafVrSWM3/kRc4lAgantPbcHn7a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689737613, "uuid": "b034cb8c-cb55-4b5b-a5d3-aaa44e4bbcbb", "value": 605184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689737613, "uuid": "339dac0d-b67e-4c05-967b-a77f2db6b1e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689737613, "uuid": "14799df7-24dc-48b9-86cb-a5482011e9e3", "value": "2qbGLDSDitx6x6NpSCcuTnYE.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d64ae752-260e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689755566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689755566, "uuid": "729c5f42-24ce-4e50-98d6-9a222f2080e7", "comment": "Malware payload", "value": "0e5adc3fdcb737338109d854cec3ff15", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689755566, "uuid": "35cb1a78-9c07-4c4e-8edc-cd8454c1b7c7", "comment": "Malware payload", "value": "43022f6ba94320f8c23eb8581f88d1341102b2f057d7f4359b51214b47d696e8", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689755566, "uuid": "aa7aec53-3d2c-48c9-9dd5-2f245c0dcd97", "comment": "Malware payload", "value": "6ae6c885035dae217fa755e8812f22004b9ea7b9", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689755566, "uuid": "79d9e74e-a0a1-49a9-a017-13d1b5f3668f", "comment": "Malware payload", "value": "1a28b90ca796721a7744914188f6a1f793b5dfb6e16724621484553af76f07523ef26c12965d2ee112557bf5a2e8e9fb", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689755566, "uuid": "eeeff1c8-dc2d-4346-8112-0282424a1864", "value": "T14355BFF876047DE63A6F576BDA96ACDC13B616638ACBA4CD806477C305A3335EE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689755566, "uuid": "8acdb428-bde7-42e2-963b-8faa9c912a44", "value": "24576:z7imjH6rZ5iyNsJrgOsc5R1RB9kWX6dUbYXdWKbNnznCwJY52nVUchf2XSEo7D3:2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689755566, "uuid": "6ca061bb-f568-49ad-b6b0-9bb862d153b8", "value": 1300146, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689755566, "uuid": "c96299d5-cc09-4369-8060-95c56f3edb66", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689755566, "uuid": "124e2004-3b3e-4b3f-9199-a75064c977d5", "value": "SecuriteInfo.com.Exploit.RTF-ObfsObjDat.Gen.25034.12427", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bffbd7e3-2630-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689770131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689770131, "uuid": "6775c978-9b94-4ef9-8f31-d52457b98597", "comment": "Malware payload (RedLineStealer)", "value": "4389b6b778b97d57b9139c1552e14fc3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689770131, "uuid": "12f11282-061d-45c1-99f0-82a6bb57d3f9", "comment": "Malware payload (RedLineStealer)", "value": "43604df6b9e49be8596a4a5e825c36b4cfc99599a783dd15e73792494931f0f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689770131, "uuid": "a39360a4-2d7d-4b39-80d9-f078febde5f7", "comment": "Malware payload (RedLineStealer)", "value": "0c42cb84374192ff693f7dc39fe3343c3d2d7040", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689770131, "uuid": "b2d27fe3-2479-414b-94f2-83b92ad0dc5e", "comment": "Malware payload (RedLineStealer)", "value": "b71b570cf8efae5b6e60ad575759fb06d42b1b966d27bae37d997847b27ffaf8bccc9c3858f1ce054c8502c3e3849e1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689770131, "uuid": "ea468c70-e0eb-4bc3-800f-1c0c8e822b62", "value": "T13DB40253EBDC9037D9B527B05CFA13831F31BCA15C7892672A85695A08B72E0A43673F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689770131, "uuid": "87f7744e-0f9e-41d7-9999-4dba803a89f8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689770131, "uuid": "d3c7f8ff-6560-4aba-a372-3da759f939cd", "value": "12288:cMrEy90HCjGuoAMXAL4E0y2cDUNR4stN4lju2qED:YywCauoAMXc0y/84mNgjua", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689770131, "uuid": "6f472f9e-3974-4f42-a682-91e85db1d0af", "value": 526848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689770131, "uuid": "656bc450-0f02-4579-aaf6-fad47cac3462", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689770131, "uuid": "0a29b19c-34fb-402c-b6d1-0293a486bccb", "value": "43604df6b9e49be8596a4a5e825c36b4cfc99599a783d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "554c16b2-25e6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689738169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689738169, "uuid": "16a6cc7d-4e22-4ce2-a043-8e59322b5da5", "comment": "Malware payload (Amadey)", "value": "0fac3e99d65c29830aa29bf71ab7f133", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689738169, "uuid": "406137b7-026b-4da9-b666-8cf3e6f6ee62", "comment": "Malware payload (Amadey)", "value": "4362f1ea4814a4e9c0ec76acfb6f301301f03af642d8866c32abe091f9c6660e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689738169, "uuid": "65fae2f4-f37e-4c00-895f-d6c40a5fcc24", "comment": "Malware payload (Amadey)", "value": "1e8b445d64c5dc471da1ea94015c1fa7efe7a7ec", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689738169, "uuid": "b7f7f10e-f9df-46c4-a66d-bef19be9ce31", "comment": "Malware payload (Amadey)", "value": "9a214b933b85a945aef30fc878370b17c47861b5b917bf02cc94c1f335409f2df8c7a5da5b5072402aafd443a5a7f254", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689738169, "uuid": "716065f5-8ad9-4359-9244-fdef61409e76", "value": "T1BE34E113EBE89032D9B5177048F603C31B367CA2AD78836B2785995A0DB3694E97173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689738169, "uuid": "027ab90e-a039-4db5-bf9f-b80a37bae3db", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689738169, "uuid": "ffbaf315-ce11-440e-af02-a1339da2ae19", "value": "6144:Khy+bnr+tp0yN90QEWhQmyJXNcrGFySYCcHnlRHws:bMrxy90AC+rGYYcHnl9H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689738169, "uuid": "e4c57a32-9b76-4a8e-8260-83857a8abb47", "value": 240640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689738169, "uuid": "0131710d-6f1c-47eb-9841-c7e410524802", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689738169, "uuid": "e6e2fdee-eb2a-456b-83b2-1df3699da7b1", "value": "y6845117.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63a24041-25e6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689738193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689738193, "uuid": "5350228f-ced5-439e-b515-6b6b04fc594c", "comment": "Malware payload (Amadey)", "value": "f0033521f40c06dec473854c7d98fa8b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689738193, "uuid": "0175d5d9-502a-4d68-be7c-18c7904aaec2", "comment": "Malware payload (Amadey)", "value": "4458a9df5275bedd921127f4ff9dc63d4ac107f2e89cf46969e96f4c43d9f93e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689738193, "uuid": "3276508f-4f0f-450c-87f9-bc77fc3c4900", "comment": "Malware payload (Amadey)", "value": "28dadfe642a0c308e1f744b0d87a6d22dd6cd55a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689738193, "uuid": "068e65ed-aca7-4016-9a97-d090e4c05dcc", "comment": "Malware payload (Amadey)", "value": "ece4be473268302cd5fc464977120ebef146e5097d67dd409360b5ea2a2538fe0bc96a5cf4b3ab285580c16eb8a5702d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689738193, "uuid": "3cc33951-6bff-4592-b7ca-a0ddaa10afdd", "value": "T1641407657912C032D971A1B619F4BFF2C59CA825ABB149DB3B800F77CA112F73960E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689738193, "uuid": "1b5244b3-d986-4a92-95af-7c211fd0aaea", "value": "f8cc61ade86cb7277d0ab974de6323cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689738193, "uuid": "d8618aad-65ec-4b53-a5fa-06afee489510", "value": "3072:7+3Z999+G2SeLaTkactpzQx6jvYESNtGkau5gf7oX7Uy+wXnfnPjt:7+H9wieuk1BQMjqNUtu5gToBv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689738193, "uuid": "b2c20e8a-6cc0-4715-91dd-97a51dab0cd0", "value": 202752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689738193, "uuid": "21a92af7-5370-4687-b1e6-9d0588dd2468", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689738193, "uuid": "64665b5d-01a9-4dd7-8b2c-ba9c69dba7c7", "value": "newplayer.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "015aea19-2633-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1689771100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771100, "uuid": "5c2835b4-7cc4-4dd8-a3f5-6e853063a64a", "comment": "Malware payload (Loki)", "value": "e1fc5f838eb9814f47705d7ee79bc2c6", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771100, "uuid": "cb006872-5844-456e-bb19-0dab6d860bae", "comment": "Malware payload (Loki)", "value": "44845f37cda705625eec134998697dc6798adadb8f1698e2806a0e93b52e5d2c", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771100, "uuid": "a5ee0d01-dced-47d3-8bee-382a8bf1757c", "comment": "Malware payload (Loki)", "value": "8fabfec85ae423678121b8f2bdd5069dd0ec7eb3", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771100, "uuid": "8a3af6b9-e5a3-4ac3-8fb5-44ca9fb2266d", "comment": "Malware payload (Loki)", "value": "8e5e41b8e4ef9ea2d798d7edfee7b7cbb37e7b05e4510152e5093fe0da93e45dcea5491fdda12778d4509d4aa9f599f7", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771100, "uuid": "acfaa8dc-269c-49d9-af47-f6169ba1c4d1", "value": "T1F5239E5AE78F02648F911377531B4E889ABDB63EB351547174AC933433EDC3A026A6BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771100, "uuid": "9a3249cb-81e5-4841-b283-105d8b7a2c81", "value": "768:UFx0XaIsnPRIa4fwJMQmeyUzGnJyxBXhxRPWjHivb5rMRCShslxr:Uf0Xvx3EMyyPJyHtPYHiVrMUShixr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689771100, "uuid": "b3aaa611-f7cf-456a-8031-86c5a06d6254", "value": 46750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689771100, "uuid": "979f4a1c-a130-4cbe-b188-17decdb9b132", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771100, "uuid": "112a0535-1fc7-4d5e-b1f0-96afd8943fc5", "value": "e1fc5f838eb9814f47705d7ee79bc2c6.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca949255-2615-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689758552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689758552, "uuid": "b3d139be-65d0-4362-891d-9db7ec4e51c8", "comment": "Malware payload (AgentTesla)", "value": "d455cfa10c484ee645c860904571cc27", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689758552, "uuid": "bf7649ad-4980-4ca9-82a2-369ee6aee5f6", "comment": "Malware payload (AgentTesla)", "value": "4484da3c76598bb0d37ee0ff055c05569ec96852f459112437ea3563441ea95d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689758552, "uuid": "852c65b1-776e-41b9-bf5f-e896f7583e0f", "comment": "Malware payload (AgentTesla)", "value": "e44608a617ab6c0064ad445493f051faff0c523b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689758552, "uuid": "9d3bfbad-3eb0-4bd1-b2fc-27bd22768923", "comment": "Malware payload (AgentTesla)", "value": "bc760a0c26095d0a31d468df1e2b5ffd86a521e4d22287d8dacbea87fb0cf612c8ebfbd050e62a1dcb0b595b0ade14bb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689758552, "uuid": "026303fb-9dfc-42ad-b9ec-494dbb51bcc5", "value": "T1D9D4010179A88713CAB48BF60264A74463BA9FDC24B6F06DDF9BEDD671B8F150940E07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689758552, "uuid": "b8824b88-8abb-431e-b83c-179fbbe327df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689758552, "uuid": "98bd1553-0fc4-4cad-b585-70b5bd5afe37", "value": "12288:UHPYPfY7A8TRBQ1FygLZaHEhBEG/CnXDFq4oX2kXqTp:iPYPgE8T/QDyUZaHEIG6npq4GxXq9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689758552, "uuid": "9c1f8e49-6d0c-469a-af8c-32bfdcfe28da", "value": 647168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689758552, "uuid": "c108bb2a-3cfd-49f8-9035-ccb9ffaf580f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689758552, "uuid": "3e2ad59a-3047-4064-8c8b-8fd73c1b35e3", "value": "Halkbank_Ekstre_20230719_080713_458894.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d02cdf4-2611-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1689756731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689756731, "uuid": "bc7fd534-3cd2-4354-811f-a1cafa074377", "comment": "Malware payload (Formbook)", "value": "d497e7689faffe7f4b58354d70ef5fcf", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689756731, "uuid": "238ecf25-7ede-4131-8801-a0a1a19e3990", "comment": "Malware payload (Formbook)", "value": "44b4eef8a260669a21c64f95af4c5ad884b77fc118be9ade37dad2b908a37bee", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689756731, "uuid": "e89f617c-bd56-40a1-b7cc-fb830bb06816", "comment": "Malware payload (Formbook)", "value": "e608aea6d75cc78ba127dcc64372f9ea6865cd4e", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689756731, "uuid": "8ed8edc4-bf3c-40ca-be67-908ce73efb93", "comment": "Malware payload (Formbook)", "value": "746187084ddf9cce4691ccf36003decf9af320d98a9476b71e50aa0cca4435275adb72c8339a0c8ae2faa8aa1fbd1659", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689756731, "uuid": "fa2de746-95c9-49ee-9d3f-a13077b49018", "value": "T103D423994DFA5623D95E3FFB441276F242A60ACB7012EB630D4AF072F344B4D9A107A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689756731, "uuid": "b7ac8bc5-02ec-4fb0-a27c-7d549b921c1f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689756731, "uuid": "a0b9dacf-b76b-4959-926a-357e8b2b4c09", "value": "12288:hmAY2kcdbL4EfGfWjBeeiSi+9R9obcLY4qt3TjfKiEeS3xjl6ayy3:cN6GEfGfWjBDiaL9oI07tDjfseA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689756731, "uuid": "b703fe25-44a3-4275-8cc7-4e4d306f65a0", "value": 645120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689756731, "uuid": "f41a2d98-dd4e-43b3-ac8c-5aa2b67a6cc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689756731, "uuid": "52948ec9-0a6d-4490-a504-3cf1303cec95", "value": "DHL Shipment Delivery Notification 18-7-23.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d14542c-25d3-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689730049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689730049, "uuid": "705b3162-c9dc-4f6d-995c-0f86c8436a48", "comment": "Malware payload", "value": "6a6c24b2e138a86e07ece17dd5aa1ba2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689730049, "uuid": "42fea225-47a5-4c52-9145-2d3bba99c7f9", "comment": "Malware payload", "value": "45549f7b795c8a725bb375501fb1fdd6582309c7f9a4d8778f93942615e0fc5e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689730049, "uuid": "6ac263fc-e7d2-4d6a-9cb7-28db027f68d0", "comment": "Malware payload", "value": "707e1d8d57b97891969e927765abf981af96089c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689730049, "uuid": "2dabd38b-4722-4c8d-961b-8c709e9b9cb3", "comment": "Malware payload", "value": "c6f0806e907e36b3889779b52721d30fadf613e063aacb6689c5b9062702bb9778bc1a04593d56c57a9e752719203ca3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689730049, "uuid": "c214fe41-cbd9-4f05-ba85-5c76af2973f0", "value": "T1D2337D017690C0B3E5AB063558AD86210A7FBD639BF884D33FAE064D6EB15D07A3D357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689730049, "uuid": "2362910c-c76d-4a8f-90f1-78e7ba4db4d9", "value": "48870ce7a0967218f26445c839c51332", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689730049, "uuid": "d04d7326-2d7d-4dd8-8a29-6852503e0b25", "value": "768:pvsWK7AOoWFVbYxtEZuWV2NKeKstyxdjKTtVQ98lTCOHTvQW1:pvsGHO4TKD7KTteEIW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689730049, "uuid": "95b338db-f139-4516-9367-fb6219fc5c06", "value": 54272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689730049, "uuid": "3dd36256-3020-4783-8d32-e9bf801c10e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689730049, "uuid": "384e847f-8611-4063-aec3-840f21c3c0a4", "value": "SecuriteInfo.com.Win32.InjectorX-gen.12078.20696", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ae91267-2659-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RecordBreaker)", "timestamp": 1689787571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787571, "uuid": "e2d0b3c5-a4e0-40ef-9d11-944861cff285", "comment": "Malware payload (RecordBreaker)", "value": "febbd07a9e489d4b139d4f44288a728f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787571, "uuid": "0a545c06-35ea-4563-9265-655fba919b33", "comment": "Malware payload (RecordBreaker)", "value": "456dd4f1c7fb4cc331cd9f11d416f4c19a628ce0e47485e1f7914b5157bcc9b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787571, "uuid": "fc8a90f2-78ec-4dc9-adb6-9a497775e2e2", "comment": "Malware payload (RecordBreaker)", "value": "6e8f777a3942d93761042cbf90f1d3ffe2710c9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787571, "uuid": "262a9233-8f7e-45bc-8266-d4feda3b17bf", "comment": "Malware payload (RecordBreaker)", "value": "9eb3651b5f7ba6738a155a18b54ea725f08a5c23c0dc2611481e3366eaeffb2dedf96d8dda285146f671dca43a5bfeb0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787571, "uuid": "946a6237-3d11-42a6-b10e-cb62900d5fb0", "value": "T13D857D04B5C485BDC472ED3609E683B24A3DF9700DD56F5B2B948A6E0F682E06365CBF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787571, "uuid": "0632a81c-7e4e-4501-9cb6-8160ff39b783", "value": "28f039ba63a716b696dd5058ca2bb671", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787571, "uuid": "578ddaf7-d0d6-4232-9b41-50dd0dde810c", "value": "6144:iKTNRHD+DOgd8q6GuIfkTfdyogB1dBz13:iKTNRHDG6hIfkTfdVgHdBz1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689787571, "uuid": "9913ab82-0b89-47b7-8820-5e463bf9dbc7", "value": 1713152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689787571, "uuid": "59b14beb-24d0-4be2-bf75-4f5e1583d934", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787571, "uuid": "ea54f115-a19e-4310-b300-2c80d55487da", "value": "febbd07a9e489d4b139d4f44288a728f.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c19c009-25fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1689747496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747496, "uuid": "75609d54-a8b1-404d-af24-2964b89dc31d", "comment": "Malware payload (Formbook)", "value": "2c5a35d58b5dffc16cd183bb7b80b1c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747496, "uuid": "32c7c055-e555-4dae-a66c-88e491096462", "comment": "Malware payload (Formbook)", "value": "459e929fa858fe59c50dc6887ce7fa9a79f13719dc5c759aa069559d2956e6c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747496, "uuid": "7b87645e-0ad6-404b-8e87-3f9b2549b348", "comment": "Malware payload (Formbook)", "value": "5e8be861e14e0e166ad04ba3d749d22f1e48c594", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747496, "uuid": "55ea4165-6012-49cd-b477-a7ee8fb31adf", "comment": "Malware payload (Formbook)", "value": "4edd63eca0b4f7e1ce6a4053a8691de832e9ccefb45e12ef0f4164d3402ecaa61a4d1175be13a7dc5c81aa4380dd5039", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747496, "uuid": "5550b225-d540-4b28-b1db-d83d0a9ff2d5", "value": "T17844125467E082B7F562D7338FBA562A27F41B3A08A4DB4F03205F493E667905E0F792", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747496, "uuid": "ca4422db-ef25-44d0-8037-44ba7d41cf53", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747496, "uuid": "7aa5f4be-8f05-494b-954d-84f80336b074", "value": "6144:/Ya6V13xUVngcPTp4SF8mUkAvXz7QD9RAVbXBWwyE36De:/YPPIdyK8Flz7QDQVbXBWwN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689747496, "uuid": "05fe4359-732e-45e4-8924-c7a8839252b4", "value": 260600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689747496, "uuid": "f31c3bec-1d38-475f-8976-c1e8c3d5df1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747496, "uuid": "f3a3ee24-09dd-425d-ac74-e9daaa8eed3e", "value": "Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c93ad82c-2611-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AZORult)", "timestamp": 1689756832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689756832, "uuid": "e491e75a-7e4f-4b56-ab3e-d48de41bf9fc", "comment": "Malware payload (AZORult)", "value": "9b13093c23ec7bd3796179496510b9dc", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689756832, "uuid": "d77f6d9b-0937-4dd5-b629-29f377e27e72", "comment": "Malware payload (AZORult)", "value": "462bed8c325e6e5081974bb46f528f8cefbfcfa800d6a0f018f28f91444d7dd9", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689756832, "uuid": "df547b4a-f107-4a98-aa73-fed73531fa7d", "comment": "Malware payload (AZORult)", "value": "1633adf7ebfc3c9d902cd31941df59e81b3c3524", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689756832, "uuid": "2a92f9c9-999a-44df-bc64-e17bbff1d1f9", "comment": "Malware payload (AZORult)", "value": "e8e07111cbb09792eebb6b8cae8d9fca54245d07a32c1bb8ac9f1d6397bbce7385314a0631fe2fdff7f7cdcdc63f4501", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689756832, "uuid": "9450d11a-c9c9-4040-8d8e-668b2c15bbdb", "value": "T128E323E79DC40B95A475FCC86D816A088A8395F104FB732FA72E314E5E60F73848C997", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689756832, "uuid": "25f3ee4f-9c93-4fa2-a952-6d973ee4f7c4", "value": "3072:BSYI5hoaFRc5K0lfSV65QWWCE6M4ZxdfwkBDy/hAfPu0OMJU1w:B5Ib/cE0lEpUE6fFLy2W0Oe5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689756832, "uuid": "6b7ad99d-b08d-496c-8600-2c939f039aab", "value": 153311, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689756832, "uuid": "0ebc080d-afd6-4482-8c75-9f5cf0fd6e41", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689756832, "uuid": "1da84752-0258-44bb-958c-2ef467bf907d", "value": "Docs.r01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3174556-2621-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689763667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689763667, "uuid": "aef42839-d6a4-40ba-b44a-02b1ce8a3d04", "comment": "Malware payload", "value": "31f19f58ddf6da70bb094822889bc660", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689763667, "uuid": "4061628d-5014-4c78-a51c-98a03b802177", "comment": "Malware payload", "value": "466fab3524b71a1f2d5aee2af42e49fa9fae81babb26aebdff98207d62f2eae9", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689763667, "uuid": "0e5bb548-6b9a-4ffb-b1e4-9843405ecfa5", "comment": "Malware payload", "value": "ab18720101dfb05929ec46f0262f76469412d3d6", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689763667, "uuid": "f3d1a2e9-0d8e-48b6-b3ab-a95be165b179", "comment": "Malware payload", "value": "85020fe22483ad9becfba07f19726d642b06b98d263361957a607cf738a99538d5c3e62e6e7cf4d6e81dc52be73a72d7", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689763667, "uuid": "d5e0f2f3-285d-4456-a20c-79a03c8aaf48", "value": "T15D05E0215F882EA9DFEC190FC0BD1A0E57F15746D51270CEAB637E4BAEAFD44410B18A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689763667, "uuid": "73ac71f2-2cf5-4780-9e73-87ad26d83ba7", "value": "24576:vyokdTt4CgAEVLLvFLfP9QG2SPmdBft6fVSqwO:anQLjFLudN89SqwO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689763667, "uuid": "d814ea61-59dd-4bfb-89c6-77072c780cbe", "value": 841931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689763667, "uuid": "7b51e095-057f-4d03-bd4a-435061af6687", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689763667, "uuid": "dade23c0-89b9-4d8d-8347-a062321815b0", "value": "a46dedda-190c-48a9-9c9b-d011168a85d0.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca36427f-2663-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689792053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689792053, "uuid": "af789750-89b4-464d-a77c-873a3c1fe5aa", "comment": "Malware payload (RedLineStealer)", "value": "3f8573bb5d976cad90622326577b1789", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689792053, "uuid": "16aae079-1ea3-4348-9c95-66e916f0c453", "comment": "Malware payload (RedLineStealer)", "value": "479a943b806c368f1c1a4d9e404d90c44175af5386e2707001554c564e32fac9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689792053, "uuid": "1581fb5c-0037-4696-83a6-6d63f49782f7", "comment": "Malware payload (RedLineStealer)", "value": "abdee642d6493512b6d40a63b764113733782849", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689792053, "uuid": "c77324ef-1b68-4c91-a19e-d5eb0ddcebcb", "comment": "Malware payload (RedLineStealer)", "value": "db0520dab03f5224281ed490397c90e52e58ac5208880a840a5ff1afae8e1f8680beab3d420ad4ffe9a8ed32c0e1fb32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689792053, "uuid": "a8c4f5b3-81b0-42e4-9b78-2c52bba499ca", "value": "T18574F113ABE98433E8F517B058F607830B36BDE19974836B1751998E1CF39C4A93636B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689792053, "uuid": "ef497881-6d0d-47a2-8d13-458e41f87d9e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689792053, "uuid": "884583c5-431e-4e2a-ab39-fd85cfdf3efe", "value": "6144:Khy+bnr+Gp0yN90QEMwqsl4VF3YR9zUuISvmCPImr9lfpX:TMrGy90ew0YR2uIczImLF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689792053, "uuid": "00dcd34a-ef0c-4b66-a094-8411ae02495e", "value": 367616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689792053, "uuid": "49192f14-f926-4c8f-97fd-2566e0c5e8ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689792053, "uuid": "decf71b9-d220-4ea3-a7b0-6b8b4cccb0c7", "value": "3f8573bb5d976cad90622326577b1789.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fe25465-260c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689754508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689754508, "uuid": "d64f8f10-8772-4588-9bd9-8bd32c71cf64", "comment": "Malware payload (AgentTesla)", "value": "7ac0d905e8c2341221c95f501e7008db", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689754508, "uuid": "7c6f3476-3353-44d0-9b64-8ddb9b7a2d21", "comment": "Malware payload (AgentTesla)", "value": "484794d12f8acdb2894d9009c17421bf0b5be491eb43273f35bdf56295b26ff0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689754508, "uuid": "62c29897-fdd1-463c-b817-ed7b901c0c2a", "comment": "Malware payload (AgentTesla)", "value": "9343ee8ea4115aaa8de1b64e3961a20482dcefb3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689754508, "uuid": "ff46ede8-8871-4ba9-b301-1924260f2670", "comment": "Malware payload (AgentTesla)", "value": "5a5d872da06f3ceab55760eb8922ba3f4823c1b021a40cd8f24eaf1b00364ee663d07d63f33393ff5a5ef7ac87e2fbc3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689754508, "uuid": "b8580ab3-67ff-4b07-946c-0d011021d00b", "value": "T134D41214A3D58A13C9FE0BF86720A70413B8AFA67A12E31E4F53ECE57067B505765B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689754508, "uuid": "2d270b20-b133-4823-9ab6-4b16e9f76d56", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689754508, "uuid": "2cee941e-ec16-4478-bdd2-a8c9a3492691", "value": "12288:QPYPfY7iag2Wuji8o5SoIGob5xSvETioMoB3dKjlvnuwwVV:QPYPgeagrueLZIlAETioxB3dKjlvnvw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689754508, "uuid": "3783c790-4d2b-4ad3-9f63-1a267e4d7f94", "value": 647168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689754508, "uuid": "79a284a4-2146-4f5a-85b2-b81af35becd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689754508, "uuid": "36a50d1e-5b45-4b37-9b13-580ea218efdf", "value": "Update Request-07-2023_xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f31a63a-25e5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Tofsee)", "timestamp": 1689737783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689737783, "uuid": "81ccb83c-93e8-4c90-b284-74c6feb8852e", "comment": "Malware payload (Tofsee)", "value": "fc078db02fe8516324e7931a548eb753", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689737783, "uuid": "c7198772-7f72-4e7a-84ce-02febd6eff4a", "comment": "Malware payload (Tofsee)", "value": "4857092f57abb1d74e1fbd33cac23113cdf94da4df0400a150facda784f52270", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689737783, "uuid": "f0229de8-f2f2-4525-bbf2-d3b2defda7ee", "comment": "Malware payload (Tofsee)", "value": "fed9099833213af354235e1abb7449ff93cf1489", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689737783, "uuid": "9a0cff3b-36b1-4fa6-9b33-da6d9c9b4642", "comment": "Malware payload (Tofsee)", "value": "15551b5a1911ffdcaaf1ceda10f134209f82c49bc074347173588c8cd8a981394d4453611cf22130e3a0a9bcfd40ff73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689737783, "uuid": "ff8aca67-b9ce-4a83-a85f-fa6db6e7f3fb", "value": "T173F60A3F616A5697F4BC52BD675F3FD060EEE66AC414483F90A888F884A5E1570CC12F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689737783, "uuid": "abb19b67-ff36-4642-98e8-fbe804c9b99e", "value": "41b4eb7c12331a5ff00a984ecb434d03", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689737783, "uuid": "9da91845-8c16-4c41-9e25-29ad77e7e86b", "value": "3072:F8BGpJ8ESLIKDYednKy+4DVBdRGMsjQ3IdDwYwLH5yBzFZCosLLLLLLLLLLLLLL/:gG2LIKtDB1CIocYwcBz2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689737783, "uuid": "d4310ecd-8b8e-4c0c-8a1a-dc0c9abce843", "value": 15459840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689737783, "uuid": "c8e67f99-036d-4407-9e38-c015f2c7730a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689737783, "uuid": "ff68e5b2-e634-4171-9438-6c8fb05b42a9", "value": "dgzkktuu.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "420e9a94-2626-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689765625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689765625, "uuid": "f119653d-f9bc-430d-8161-b6d9b0c6e596", "comment": "Malware payload (Amadey)", "value": "078e639bdbe157831788e26267526968", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689765625, "uuid": "1317a5e3-c487-49a5-8096-4a178faa8604", "comment": "Malware payload (Amadey)", "value": "488c7cb3b3ae680032b59617bf38fb807c934eab7717cda13ee71996311ea718", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689765625, "uuid": "fd7eaaba-a7af-4cb2-b6db-5d13dceb81c6", "comment": "Malware payload (Amadey)", "value": "0b642da53c3113b7494a76d768dd718f2dacd118", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689765625, "uuid": "7cf168a5-e9f2-4267-83e6-08cba79e1466", "comment": "Malware payload (Amadey)", "value": "4ffa0f20a3fcb6698bef822949b89d3b909298b1717cc7f97d5dd89c46bba2bfb044c4b607983a6deae1b42ffcbee0e1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689765625, "uuid": "8dfed6e3-601a-4cbf-b739-409d4eecd6d5", "value": "T1A7840212B7E88072DDF527705CF202831B3ABCE16DBC93AB2785A45E59B3594E43136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689765625, "uuid": "6b2ee9f1-d1ef-4373-8c18-d457a5c80b91", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689765625, "uuid": "bfee73c5-2377-4e6a-8690-2504597b9c15", "value": "12288:cMr6y90GnTK6c3hvStGHQcHnl9DPLxUe:GyHe6c3tStSvH3LxD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689765625, "uuid": "ff136564-c327-4a37-85b2-abcdf9768b52", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689765625, "uuid": "29667ce1-d0ce-41c4-8ab7-51498a19bf2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689765625, "uuid": "b6ace17a-e757-4109-9e78-71d5e639c6d7", "value": "488c7cb3b3ae680032b59617bf38fb807c934eab7717c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be799120-2637-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689773135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689773135, "uuid": "078c38c5-114e-47af-bc33-5b55fecb09ab", "comment": "Malware payload (Amadey)", "value": "48d8dd6d47882bd5e0431a0cf6d1a552", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689773135, "uuid": "e3575a93-0013-4b84-83e4-395c3ea50566", "comment": "Malware payload (Amadey)", "value": "489287cb76171eb013ef8276977586b53061bbfae58f0a22402bd5aa83ff8d28", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689773135, "uuid": "1fdc8940-fe37-42b0-b446-4723a9e1eca2", "comment": "Malware payload (Amadey)", "value": "47b7610f1443096d9d442b5d8bce9054c8d529c1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689773135, "uuid": "30528760-03e2-4f51-9453-42f579be297a", "comment": "Malware payload (Amadey)", "value": "f5c25d92b1fd7b5ab7c2da3f2c5060ff220b3bcfac3c34add944fdfa6319eedcc59c9134e908e4df9e8e49fbaeaec3de", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689773135, "uuid": "1f262f3d-114a-4dfb-9818-afb55d5b78c2", "value": "T1A4B41202A6DD4033F9B427B018FA13D71E397CE0997847AB2701A99E1DB2794297673F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689773135, "uuid": "12a6923a-d680-4e3a-9160-8c7b25c55535", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689773135, "uuid": "505cd06d-0067-4d06-a348-cdafbb7bb705", "value": "12288:QMr9y90kVhlZSFHR0jsIpCE5NLNbPbE5uhI7tibmQmYoL:9yTZ60BpCEMuqJ+mEoL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689773135, "uuid": "7d095b7c-530b-4750-9959-207ab5964063", "value": 527360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689773135, "uuid": "251dad4a-b0c9-4471-9bfd-d983f91f71fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689773135, "uuid": "11cf28dd-4385-483f-8c75-68b1eb4e8ac2", "value": "48d8dd6d47882bd5e0431a0cf6d1a552.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4f29c65-25f8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CustomerLoader)", "timestamp": 1689746034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689746034, "uuid": "6bc42994-e553-4b8e-906c-2d7394e4764d", "comment": "Malware payload (CustomerLoader)", "value": "a36af8ef6f8f7667b6996e710bfad408", "object_relation": "md5", "Tag": [ { "name": "CustomerLoader", "colour": "#57A5C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689746034, "uuid": "267d3997-112d-4736-a739-f23e9ac9a5b0", "comment": "Malware payload (CustomerLoader)", "value": "4923c87112bf8dc456e0d46a0401151efc304b45c15f10655d1a51711f65c81e", "object_relation": "sha256", "Tag": [ { "name": "CustomerLoader", "colour": "#57A5C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689746034, "uuid": "16c9af6c-7f55-4814-9737-9354de4a57ea", "comment": "Malware payload (CustomerLoader)", "value": "96fcfba634fffaceca1decd07c35bc61da45490c", "object_relation": "sha1", "Tag": [ { "name": "CustomerLoader", "colour": "#57A5C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689746034, "uuid": "a715171f-b965-49e5-babd-6545e79a929c", "comment": "Malware payload (CustomerLoader)", "value": "096abb9442dddcc4033ef210601d82ad52bdeec32e15e35be6e45f6dea416fa4acc1291eae351708fde6e94431410cf3", "object_relation": "sha3-384", "Tag": [ { "name": "CustomerLoader", "colour": "#57A5C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689746034, "uuid": "067002bd-f80f-4aef-9099-2c8a3356f979", "value": "T1484481C5E98455A0DD19AB70AA37CD3542237EFDA874A42D28DE3E273FFB2931026053", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689746034, "uuid": "26f79bcf-58fe-455e-9af6-499542ec43d9", "value": "6144:jm7o8HSAkzL7r9r/EDppppppppppppppppppppppppppppp0GB:jm7PH+P7r9r/+ppppppppppppppppppT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689746034, "uuid": "a68f21d4-019f-420b-a4e9-1911649e72a5", "value": 253952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689746034, "uuid": "584ff278-ab12-49d7-bdcf-48b5841673ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689746034, "uuid": "cb8d1680-0cee-4e1d-8abf-9952af2d9cc1", "value": "MFG PN VJD1AN0B-A9C45-100.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc4a6732-2622-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Hydra)", "timestamp": 1689764219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689764219, "uuid": "dce114cd-ce0b-4f11-8f14-6e3442014c72", "comment": "Malware payload (Hydra)", "value": "3ef0f55fb4451b89f85ff2a10486bbdb", "object_relation": "md5", "Tag": [ { "name": "android_hydra", "colour": "#626579", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689764219, "uuid": "0b30a44f-8ac1-4f1a-a7fb-d360f85659ad", "comment": "Malware payload (Hydra)", "value": "49c6811cbea7a607d6c50a1a013545d3f3f21d4033f3367e0f3b32bce472f0b5", "object_relation": "sha256", "Tag": [ { "name": "android_hydra", "colour": "#626579", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689764219, "uuid": "c26da741-48b7-41ba-9e5f-ddbff8031241", "comment": "Malware payload (Hydra)", "value": "c91766222854a84cdeb951528fa8654536d9be52", "object_relation": "sha1", "Tag": [ { "name": "android_hydra", "colour": "#626579", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689764219, "uuid": "10af357f-9e3c-42cb-b224-a01d71ce338e", "comment": "Malware payload (Hydra)", "value": "32729123536fc5ac61bbde2a5792eb8dc98c2a99a11b841554820986bb7e2ae560ea732caadf206aff01dc855f4490a6", "object_relation": "sha3-384", "Tag": [ { "name": "android_hydra", "colour": "#626579", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689764219, "uuid": "c17b5614-afe1-4178-a71f-c5996a8caa53", "value": "T14F163344B594A50BDAEA4770D8739A8086773F3ADF26A50B70A4331C6A738D10F64E7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689764219, "uuid": "52bc0ca0-b964-4759-bffb-170bcd3bd44b", "value": "98304:jJklXRPKOGN3Br1DEjESBmCwRdbk17vXraQvq3X/77wN90PXjW:jGBcwgCVPQzCoW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689764219, "uuid": "03653c1e-4c58-4ab6-8fb1-ab48d0a3d093", "value": 4044584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689764219, "uuid": "62a8912a-064b-4579-8041-3d10f7f19202", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689764219, "uuid": "f73a9a31-eb20-480e-9fcb-a0757592992d", "value": "Commerzbank_Security.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fe7a9a1-2672-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689798263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689798263, "uuid": "61c15484-103a-4e29-88b3-7b355549426b", "comment": "Malware payload", "value": "d55a73255847fa0376618c4ca796a97e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689798263, "uuid": "fbaa3c60-14e5-48c7-8fa8-fb51edbad1b4", "comment": "Malware payload", "value": "49e784eab99ba5a49dcb599feb43e9b3ab86b97567f59024b81de1b0bc4f14f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689798263, "uuid": "5bfd17f5-62cd-4653-8cd3-b531208ac3d0", "comment": "Malware payload", "value": "81fd9f5d1065d3805427ce08a0d544e68957a45e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689798263, "uuid": "154eccd7-7286-48f2-8577-90ea0a4bbbdc", "comment": "Malware payload", "value": "44a1aab5ff43bea9170a5933f56c6d945b23b151f5135183e43ac1d0ada91b6d678ad8d3f1609ae9ee2ca39c89addf12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689798263, "uuid": "427f9482-aa30-4c0e-9a3b-353fe8cd655c", "value": "T12763297BF6EA6BA6C51C497039D6CBE167A3B4260E47061F2081736B7D30E357D2A603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689798263, "uuid": "02ff53af-1658-4bfc-9943-244a6c8137fc", "value": "f3c64d499c089b5d2c4dd9fe46c1d23f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689798263, "uuid": "9683de62-0efc-4c79-90e9-220adb52243e", "value": "768:2aPQ8DnkPebaRTNGZb0BiParSESpcB8t47GG8dXzWzsrpCW6O7SSH082WcfaA7Zs:xaRTNqfsJp8t4UaotZNcCw14dF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689798263, "uuid": "d9dc7132-eb42-47f6-be2d-d1a156a30926", "value": 69632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689798263, "uuid": "5db67bc3-56a6-44eb-808d-e4f9ebf7a743", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689798263, "uuid": "42bcac0e-6a89-4d4e-aa68-50195ac3e2f6", "value": "Planilhas.xlsx.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79ac4f01-263c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1689775167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689775167, "uuid": "f64f5625-2d6f-449f-9a85-d4cc5da3afef", "comment": "Malware payload (Formbook)", "value": "bacd8202f058ddcc5fddf57f8fce99d8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689775167, "uuid": "546f600f-b5ff-4e35-8509-da7ab2aa76eb", "comment": "Malware payload (Formbook)", "value": "4b6eb1fa81423abeb496eafc4d4d7c768e3c571294d7030c7a52935068166e1b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689775167, "uuid": "28cb9363-acdf-41e7-978c-fa3a0942e213", "comment": "Malware payload (Formbook)", "value": "69ad6ec02614bbb0db78152add85c25161dc6a80", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689775167, "uuid": "a01ef29f-0261-42ff-b88c-dee95e24dc40", "comment": "Malware payload (Formbook)", "value": "6e0d1c15af7a650735d0cf3f3d5daf18484bfc213122ab9337b96b5125eb13d4a3c40576b1c8f191979139eb260cdfb9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689775167, "uuid": "374aefb8-14fa-47c0-a933-f4f1c37cc715", "value": "T13F441220AAB8D45FD467277A09390B54EBF4FA2674349A9F0316AF1C7C122919E1F373", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689775167, "uuid": "9430a274-8859-4611-b6c6-f27667ec5b63", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689775167, "uuid": "85a99638-1971-48b1-bf6e-6b6a705dd9cc", "value": "6144:vYa6IDRFsZTfFSRGOPTWtUuuPjhnttVP8E/vYKc8i4Y5NYe:vYeDATfsTuShnVPhYKxHe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689775167, "uuid": "00279faa-54af-47d6-90ef-68895190edd9", "value": 262585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689775167, "uuid": "4dfbd22a-7a28-4855-8525-6b77cc827bcc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689775167, "uuid": "6d05b806-ff74-4d38-9607-be1fb894eb0f", "value": "bacd8202f058ddcc5fddf57f8fce99d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "495430e8-267d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689803003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689803003, "uuid": "af944dc6-a9a8-438e-a40a-041524091d9d", "comment": "Malware payload", "value": "3c4065e9ac7ff4350d190dcda4cd6b33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689803003, "uuid": "5c57e5cf-60c3-48f4-90a2-aa4eb197d46b", "comment": "Malware payload", "value": "4b821e183fd57320849d7999495a583e0a74ee4bcffd59daefae37534f736393", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689803003, "uuid": "eb47895b-18fe-4cbb-a7aa-6b7c50a9e80d", "comment": "Malware payload", "value": "6e26a2a9d9f5e7988f148b9cf270e3972cf0a922", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689803003, "uuid": "ca22b957-e7c8-40e2-bc08-f326aa732cc4", "comment": "Malware payload", "value": "3964c4c8777b4d5f2ce3a2ceb433fa21076c19d31de32189d941813e5815d13f7bcd65708cd89314d6dbfbdf50606b5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689803003, "uuid": "fe079da9-ed5a-4c50-9c0b-b3779fff2ff6", "value": "T1C974F15237D5D032D1F76A300178D9922A2ABCB15FB640C737983A3E6E702C15B7AB97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689803003, "uuid": "a1d0f6d9-6300-4f85-8c03-0e11efb631fb", "value": "02f23a44e70611470e4c2107da6d7f64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689803003, "uuid": "e5eaf2ff-51fc-48e9-be1f-87dad7305d20", "value": "6144:1I6Qt4QwsdOEcetGRU87bZQAdBSa9UsqigzSGzduirJ:It4EDVtoU8HiySadrYduC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689803003, "uuid": "f2fb0b75-1271-4e21-9703-a1f377495ed5", "value": 361472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689803003, "uuid": "96cb92d0-4674-405d-b144-11d7df0c636b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689803003, "uuid": "b2f186c1-0f05-4802-905c-73176c40a79b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55ac95bd-2632-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1689770812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689770812, "uuid": "f67dca64-ddc6-4611-9927-29abf0c8f6f6", "comment": "Malware payload (SnakeKeylogger)", "value": "b991a513b8bd33bce6014a6907461eae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689770812, "uuid": "4cd1a323-5f1b-42bc-b1eb-fdb9f1731dad", "comment": "Malware payload (SnakeKeylogger)", "value": "4b899a1465e8a93502b8eff43fcc1c925fedd246148b02bf50d7f177ab7c2d52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689770812, "uuid": "8d7ae4bb-45a7-4dc3-8213-95d9488049cc", "comment": "Malware payload (SnakeKeylogger)", "value": "f72d34ea76d3ca8aee95419a46d862d137ccae14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689770812, "uuid": "6cbbd56f-4d32-4ab4-9698-371e8fffed57", "comment": "Malware payload (SnakeKeylogger)", "value": "c912feb9318dd37cc87ecf8f004c0228e726fb22b5018ae8e56cba795a4ed5926512167ceb095a8dda416b559c96ed49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689770812, "uuid": "b4715a9d-8ac2-4cc0-ad2c-186de39231eb", "value": "T1B9D412007EA4AB13C574CBF94215BB5423BADFDC2061E02D8EEAFDD672A5F140A50E5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689770812, "uuid": "78dfbefd-029e-458c-bab9-43fe582dc9cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689770812, "uuid": "0ad6bda3-0a3a-4ea4-8b33-cca03e5d908e", "value": "12288:f5PYPfY7apHdIi5iDTe4Nsb/qyDbOYPg1gUlhtB0OJzRkhkzLRcka:BPYPgGpnQDTPGzDbrYvIOJzG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689770812, "uuid": "f19dd1a2-0e2b-4a1f-a37c-b8c850103953", "value": 604160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689770812, "uuid": "d9af6e6c-6f45-462d-8fd5-1cdf637a7ab0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689770812, "uuid": "f4089f70-abc7-4e8a-8b97-0777398792a7", "value": "FRA-XwcKdMDcpcV1Rjr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0187d1fe-265a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689787850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787850, "uuid": "19601bc3-f811-43ff-a763-a0f7d1b4b71a", "comment": "Malware payload (Amadey)", "value": "ca9526f8ce9c752b5a8be66e90408e89", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787850, "uuid": "fff38592-276d-4110-b800-9405e04be767", "comment": "Malware payload (Amadey)", "value": "4bc126b770555f6fc86e916954837301953c7a8dc0f97f25e94da098ae968198", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787850, "uuid": "8c4d3ead-cd68-460d-b5d4-edc3966cd23a", "comment": "Malware payload (Amadey)", "value": "ba5c9878e3d58eaeb2cef24ac8f032f31c5dda31", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787850, "uuid": "42c279ef-c90e-4c52-8702-241b59bcee6c", "comment": "Malware payload (Amadey)", "value": "eeab4d52c1714b77e18400ca29efb7a1b52f50da2e5452637f50c749a321c3b8e58321e897deb127ff81d4b5ac09eac0", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787850, "uuid": "d2bb7496-4c22-4565-9263-eaeac88964a6", "value": "T1C9840252EBE84473ECF01BB028F302C31F367DA19DB957AB1789994E0CB25D5A43476A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787850, "uuid": "f91153ff-44f3-4d82-881f-5d0457942cbf", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787850, "uuid": "68d79b28-0e10-4b6d-b3db-c30dbc5cf959", "value": "6144:KWy+bnr+jp0yN90QERf+G4la5iR+5ZKlfynCK902aspzGA8sXGn0BYz6J:iMrby90b+G4li5Yx2aozLHW0BX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689787850, "uuid": "1f498fb4-2de3-4722-8485-8dccf2cc3dcf", "value": 398336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689787850, "uuid": "f71b9a89-b2c0-432d-b6cf-4875b17555ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787850, "uuid": "680dd073-67c8-4b35-b611-282abc79efb5", "value": "ca9526f8ce9c752b5a8be66e90408e89.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03e22bbe-25e0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689735456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689735456, "uuid": "3836398f-3a44-4017-8de7-9a72e5935645", "comment": "Malware payload (RedLineStealer)", "value": "ebf57fedb92e9865f19456e646cdd345", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689735456, "uuid": "5f715a34-ea23-401e-9145-b4c9e2656439", "comment": "Malware payload (RedLineStealer)", "value": "4c3b0c1e5e66b0f794e09afe724a3a805610becebc02741f009603ab2e2bb689", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689735456, "uuid": "f7a4da6a-28bd-4183-a3d6-ceaf6450024a", "comment": "Malware payload (RedLineStealer)", "value": "cd2f67a847681fe0209a6bf43fcc9b43e7b5b4cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689735456, "uuid": "3f9b6e49-87db-4ab0-a2da-7161452445ea", "comment": "Malware payload (RedLineStealer)", "value": "ef092526cd76bf90cb759674b7ecbde61a54c859a19172b198c2dd268cfd75eb65c0a84c09db5bff6d3af7cfedc36055", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689735456, "uuid": "094f4b9b-afd0-442c-ab64-72fd9faf88ad", "value": "T107355B10F85F7271C9AEA0BB8BDDEB20539CE8A0331A05DF579847F9C6231F16A36645", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689735456, "uuid": "2751f2a0-f98c-4bb2-9ddb-b085f204c087", "value": "57423b5afae18340d4d20251213d0ae8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689735456, "uuid": "4180eb96-3342-4860-a273-0b36de865d94", "value": "12288:tSuBTTZDpCZ+6VPwEiuHcciBdu9B/uaetkQrPLV1:4wnEiHpO1Sx1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689735456, "uuid": "efc914a2-2ef4-494a-a53c-743845ecaf90", "value": 1071616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689735456, "uuid": "c2a57837-1412-48d1-9fe5-ba7ae244e6b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689735456, "uuid": "5506af08-d5ce-488b-987f-8eaccbc79100", "value": "iHts4Q6y.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "010e0f64-2618-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689759503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689759503, "uuid": "5916a7f8-60de-4d38-aa45-2106f159ccc6", "comment": "Malware payload (AgentTesla)", "value": "fbbbe84a62e1634738a0cc8665ec588e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689759503, "uuid": "152bd523-b1e4-4092-b4d8-d546c7974097", "comment": "Malware payload (AgentTesla)", "value": "4cf806a71adea5b039528773d5857e5386af8aa61ad773c2d7857c9e23cc6feb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689759503, "uuid": "f034153e-87ec-4e48-bbe8-fe86739ed22c", "comment": "Malware payload (AgentTesla)", "value": "31ae0d1732a8d363c7c33d95c96a53945106b21c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689759503, "uuid": "f5b865e6-93dd-4321-b30f-dc0fbbe926cd", "comment": "Malware payload (AgentTesla)", "value": "13a0d1c53325d207e8945257c78dc414e346f0f417170bdf8a0835abd9d83b9464918f8c41596699dcbb0f9aafbf43ae", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689759503, "uuid": "fdc731df-d918-4a50-992e-38b67bf01415", "value": "T190D45C9F35B8C68BE55976E074224239C9EE842F60DEE7482B24E4D81AD93FD1054FB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689759503, "uuid": "4870cf36-510b-4622-b267-3c6181c7b3a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689759503, "uuid": "5b790972-9e3b-4c15-a8e8-30f812fb1c9e", "value": "6144:pjP7i60+RE7KTypASKiC9NJtbp33Qaw1dkutMn/bObJqnDMMLnbKxSkvnFczB9AK:x80GKTypkiCdt6awHDtvJnWmHQzwJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689759503, "uuid": "b17b23a8-a700-425f-9977-cfe4d3f293c0", "value": 648192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689759503, "uuid": "50265212-8cb7-4528-9c79-b08c346950c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689759503, "uuid": "0fe3a46f-8e65-49e4-be97-6e8dc6229fa1", "value": "Remittance slip 060223.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77dc75e3-2664-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689792344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689792344, "uuid": "d924e6bf-6812-4eee-bc42-5f5ea105d7e0", "comment": "Malware payload", "value": "c683a82dc2e6a748a246c72f60b6ad32", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689792344, "uuid": "9c062943-de67-48f9-8044-76c0ad9f820c", "comment": "Malware payload", "value": "4d3389df700ae80e56bd7bf5d17a4d8d5b53330ffdc85f1435b646c251b11551", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689792344, "uuid": "cb800437-9e95-404f-87e0-4e306cc944f9", "comment": "Malware payload", "value": "cdd94820f9a41f8f7a9c60ed12439d48a585df0a", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689792344, "uuid": "13f29f22-a0f8-49e4-8824-5441568e8f99", "comment": "Malware payload", "value": "8e31b6e3781c4e731024f0412874a14ac23e7ee5cea6db22a24238fecc037d37df5d92537ba1f7eee9e4b10a3944a7fc", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689792344, "uuid": "671a78f4-ca86-4eec-a838-9380f9c9c831", "value": "T17D579E075E551B62CB82C3B261DE28D3862DA70C137314CF59A2B5540EFA7ACE3F66B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689792344, "uuid": "98cc87cf-05d7-45fe-a5f0-52eb9ec5ee16", "value": "393216:BySSQEPrmzSMzriXP7kgpk6KIHa8Gpm1z99lDSa7ec:BFSfrmk7kpB6SWz99Ia", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689792344, "uuid": "cdb061ad-7b41-4b5c-853a-785fb68eee97", "value": 29589504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689792344, "uuid": "29c21210-8e63-4909-9bcd-6c518f5c0a07", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689792344, "uuid": "1f82cd5c-370e-4111-ab07-679c9d103ba9", "value": "c683a82dc2e6a748a246c72f60b6ad32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6e32942-25df-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689735434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689735434, "uuid": "88ea13dd-fabc-48b7-bb77-3673e52975e0", "comment": "Malware payload (Amadey)", "value": "8c6b79ec436d7cf6950a804c1ec7d3e9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689735434, "uuid": "bc76f65b-cf05-4074-9c1d-7d658a1def2b", "comment": "Malware payload (Amadey)", "value": "4e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689735434, "uuid": "d8a8a3ec-5cf4-405f-8ee5-21f654c41803", "comment": "Malware payload (Amadey)", "value": "4a589d5605d8ef785fdc78b0bf64e769e3a21ad6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689735434, "uuid": "a0708ca7-993b-4008-bd47-00061a78a989", "comment": "Malware payload (Amadey)", "value": "80092de6d8638ec688241260202a4e7feee0b3e4565985eace6da4cace42385d5ce074dbac21365a60242d08449ff0a4", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689735434, "uuid": "3b397bb6-04a1-4f11-896e-1ce803f0970a", "value": "T1682407557912C032D660617619B4BFF2C59DA828ABB049DB7B800F77DA112F73A70E3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689735434, "uuid": "9bddd3a9-9f99-4a18-8743-f6af3a62e83f", "value": "698e68059e2b8538f873da69a2766d48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689735434, "uuid": "a187276c-7fcd-4c3b-a381-1d493893353c", "value": "3072:oTzC4usLP+wOULUFAB3i9nyRA4/Prk3huiPFSbuZRuNcZVKOUm8LHIMbffWtsm3:oTzYsLdf/Rity237PFHRuNcPKOK3+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689735434, "uuid": "23896b89-dc5c-482a-b011-d2e06e4111ce", "value": 229376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689735434, "uuid": "2e57de24-d5d4-4543-a617-3eaa6293e293", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689735434, "uuid": "37496068-8671-478c-99d5-3aea573f84cf", "value": "g1196880.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d7de584-261e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1689762315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689762315, "uuid": "c87cc435-526b-4881-8972-6e7d70ca740b", "comment": "Malware payload (DCRat)", "value": "ccd75dc88dd86f8d5064f7776171d642", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689762315, "uuid": "7c2690cc-9aba-43cd-9168-8dbe8b29e06e", "comment": "Malware payload (DCRat)", "value": "4e48285959c170e0e69c81e6eeab39c1f9d167c7ed4a8f8d898481a43d9ec03a", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689762315, "uuid": "859d0e16-6049-45fe-b7a7-359a71be66b3", "comment": "Malware payload (DCRat)", "value": "cf1b737a4da6f9cfe2cebde015df1be6ee48df3c", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689762315, "uuid": "da2683c6-31e7-473f-ae00-2acad7c1686d", "comment": "Malware payload (DCRat)", "value": "b348b4f90dee87a509e94cce9db717169a6a32b28b8c5e0aa5f287ce8c1accf87a3e8ed336b5d75451666370413212d1", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689762315, "uuid": "d1ea1aff-9a6f-4f5c-9e98-49a6893ea6a9", "value": "T1865539127AC4DD12D02D1637C9EF962447A8FD023BA2C71F7E9A3B5C65163A30D2D6CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689762315, "uuid": "dcaa515f-d1ef-4984-b687-26e8e2a73353", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689762315, "uuid": "d56e317a-0fca-40b5-8f5b-0400bddc9e77", "value": "24576:H2G/nvxW3Wr00SP0Z+yIBX/ek4szaejtf3z7u+45:HbA3Ulw0Z+ck4Orle", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689762315, "uuid": "a6a0f4c9-f989-4c80-9d24-27b5b18d041e", "value": 1393307, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689762315, "uuid": "2ca28d7e-2c6b-40ca-9237-74882b81a9a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689762315, "uuid": "cf0a0914-b797-4d27-b71f-1994704330d9", "value": "HEUR-Trojan-Spy.MSIL.Stealer.gen-4e48285959c1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69917952-25fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689747652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747652, "uuid": "bb231030-fdd7-4a51-8855-ae1e49332d69", "comment": "Malware payload (AgentTesla)", "value": "091f63f50cf528beab853a2915b9d794", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747652, "uuid": "226216e9-8baa-4143-8b61-28dacc6be016", "comment": "Malware payload (AgentTesla)", "value": "4fd2e6ca5cc9b06836f597b1b002cbe1d9faf6083a10b9403adf81bad85dd981", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747652, "uuid": "a9ef37ba-466d-4a14-805a-7c2d7b4c631c", "comment": "Malware payload (AgentTesla)", "value": "952fe3321c71605a7dc4cba6fef2178df47eaf42", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747652, "uuid": "c8004c04-77ee-46d1-852e-75acae4d6f96", "comment": "Malware payload (AgentTesla)", "value": "1e62d93ba81765d1bb7054cbf60f438be1c59b206665cb436ffed9d2e0a91bdfbf703018d278512c4bddcda72d0bcd26", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747652, "uuid": "a0a84e48-b5fd-4848-9031-ce6d6342a90d", "value": "T12DB5591437876CEFCAAE65F2AA67A19B90E2175D7B31E70ECCC191DEF61B14069438C0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747652, "uuid": "f2d2c103-e28e-4754-801f-c982b01cee6e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747652, "uuid": "4467dbf8-ecf9-453e-bd80-2fec51a3e642", "value": "24576:bBrd7wUSjPhEv2VpiAUQ2WDNrUukBEKu1fHGvpaiw0Ck8W9T:bBr8PeWHZNwEf8aiw0CbW9T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689747652, "uuid": "6cd1bfaa-289a-4680-9a50-d094074207e1", "value": 2448896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689747652, "uuid": "a599f208-52ad-43a4-bf68-acd63fb22cb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747652, "uuid": "3479c2ee-947c-4524-b9b3-90262ff80317", "value": "REMITTANCE_ADVICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67676169-262b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1689767835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689767835, "uuid": "e4f84950-a3b0-4c83-978b-260ed982079e", "comment": "Malware payload (DarkCloud)", "value": "157b32a3be2d4086e30791c096ac89d3", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689767835, "uuid": "b641b07d-417d-47c7-b9ca-bbcea69de18d", "comment": "Malware payload (DarkCloud)", "value": "500546314c612ba53f7c5ba4a2a48fefc627f967d885628887a39b253ca84ea2", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689767835, "uuid": "18ba585c-2f95-4a2a-a729-6c659ce9e575", "comment": "Malware payload (DarkCloud)", "value": "e391ef105902acff54e472bd28f59d3989f10137", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689767835, "uuid": "9b962bf1-3b07-451c-a755-3f562b036a88", "comment": "Malware payload (DarkCloud)", "value": "669d1fc96c93eb09a1bcb4c3802d5e5abf2de885d3bdb525b8424887b6c7e78b936220e2694c41daced2d54685a48518", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689767835, "uuid": "d2ecd5b1-579e-4a0d-8b4d-f4465dabe69d", "value": "T1597412043D288853F86143B11DB707067BADBF1A9C50E61F27906B7876A7583AD2DFB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689767835, "uuid": "148c67bc-2323-49ff-88f1-1d8824a8409f", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689767835, "uuid": "7cc8bed0-f1e5-4554-aaa7-10c6c9ca878b", "value": "6144:/Ya6E2BEfPv9jEthOTJHr8a/zcG/YH85Ij3ASl7cdPPUqSt+0Qod7qmByte:/YaAwPv9jEthOTdD/e85ZSydPPAt2odV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689767835, "uuid": "558d793b-0014-401c-9ccd-1663d0c2c68d", "value": 347418, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689767835, "uuid": "4f5b1787-6a7e-4b4d-a1fb-7e3cf8a3dfc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689767835, "uuid": "05bcb165-526e-4e0b-9542-04964ed5fa06", "value": "payment copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da2eb55e-2624-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689765021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689765021, "uuid": "bc7c153e-b49c-4ee2-b193-dc48a6fbf8fc", "comment": "Malware payload", "value": "1a57c4b445b00024c1bb185eb5a3e814", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689765021, "uuid": "7fc7db70-992f-4ae5-a89e-db1cb318145a", "comment": "Malware payload", "value": "50547a28d392202f1abbfa416beaefe62839422848a1ba53979a2f557f0bdbcc", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689765021, "uuid": "c2dfa039-35da-49b4-ae9b-5069722d134e", "comment": "Malware payload", "value": "6d59a75455b212cb8c30c231a908389a546e262c", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689765021, "uuid": "08716992-2ec3-4ab7-a275-607e716aa280", "comment": "Malware payload", "value": "b2ec3b805b567c3f6c8a66b5f70cf073b6d8d0bb833780ea5557398cb99f4588776621280cb455e115800dd1db49a50c", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689765021, "uuid": "1f26ebf7-9604-408e-8382-8b482dc9d9f6", "value": "T1A742AF91BDA26C02F57066FA3BDAC78765B41A70D3BCC58B708994DD7584F78010FBA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689765021, "uuid": "582d905e-611f-41fe-9778-f4a8db286d39", "value": "384:lY+GlELmKYlXO3hUDueEUx4R5aghrWF8bR1FWUnJB:pg/lXMUDuWwpoFqJTnL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689765021, "uuid": "8164dca6-def5-454b-a60b-2b3940c3b759", "value": 12485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689765021, "uuid": "e278d7da-09bf-4c9b-95b9-064299c8e9ef", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689765021, "uuid": "ad43059f-c15f-45c5-b614-982437ba3988", "value": "11213951316.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c83cdfa-25fd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CustomerLoader)", "timestamp": 1689748114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748114, "uuid": "85c61b71-b049-49d8-94fa-667a4fb59e56", "comment": "Malware payload (CustomerLoader)", "value": "e464158d808ec8d16a3dcaf83e56676d", "object_relation": "md5", "Tag": [ { "name": "CustomerLoader", "colour": "#57A5C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748114, "uuid": "ce029edf-039c-44dc-bf63-56bd5d3e2b9a", "comment": "Malware payload (CustomerLoader)", "value": "5340c12deafd1e47beff8ea66df02a83b56a4259c1830c7fa02123bcbe9a1992", "object_relation": "sha256", "Tag": [ { "name": "CustomerLoader", "colour": "#57A5C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748114, "uuid": "de6150c6-fca4-4cbc-ab3f-5bea7dddf9cf", "comment": "Malware payload (CustomerLoader)", "value": "2504d48d5ceb1e220379e8cc4813add7f0ee3a93", "object_relation": "sha1", "Tag": [ { "name": "CustomerLoader", "colour": "#57A5C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748114, "uuid": "f84c43d6-dde6-4cbe-8b18-56f7919d3715", "comment": "Malware payload (CustomerLoader)", "value": "5c813083a915cc771ec0858203d3270ede6c6ae3457098132ec0e7ac4dd2f7bc8cb0e41d5a3d1d2f7ca384137abf05b4", "object_relation": "sha3-384", "Tag": [ { "name": "CustomerLoader", "colour": "#57A5C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748114, "uuid": "c3761720-64e3-484a-a5a3-ed23e15fe76d", "value": "T1E403CF0057E841B5D6A70B7DDCF2024207366FA7D86BDF8BADCC524E1E133291B227A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748114, "uuid": "6e7f556a-2394-4a83-9413-cbdf387d136e", "value": "768:mlnUOA5W+73M2F7Tllmu24Ra2DovIieNhIPVQPaoaA:o+g2JTll92m7ov0oWDaA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689748114, "uuid": "b108f618-4641-4996-8822-987485c41b7c", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689748114, "uuid": "d96b19f5-df77-4bd6-98d3-d329cff27c92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748114, "uuid": "a1999246-b01a-4f8d-b92d-112ef9a9a405", "value": "Payment Slip\u00b7XLS.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72468647-2601-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1689749814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689749814, "uuid": "a8b7b039-22f7-40fe-a702-6aba2bc717cb", "comment": "Malware payload (Loki)", "value": "9c72d48f384e384c0e3b159f4039298f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689749814, "uuid": "66c0e110-a400-45ec-88a3-206fd442e314", "comment": "Malware payload (Loki)", "value": "534a33086797b472985eabb41713da176538a199d2bc421d3b49eeec88fbedd8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689749814, "uuid": "555ee34c-c4d3-4313-9ff0-8570e08af932", "comment": "Malware payload (Loki)", "value": "469a13477837c1f48bb7a2e1b9f08710145209a8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689749814, "uuid": "e15f3138-f34a-472a-8172-a31a0a6147b9", "comment": "Malware payload (Loki)", "value": "184508b9e08402614862cf28259f9a2b90da34d8da63677948dcb6c0d9a20daaa0ce51dcbab9c6b050b4f3c0a76d9bc0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689749814, "uuid": "c03a3886-fb69-46a2-b3a3-4ecdd128e645", "value": "T1D854A6C392913D4DEA268B729E1FC3EC770DF2508E8A37695119AA1F04B11B2D1FB725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689749814, "uuid": "11de7fda-fe6e-49ae-bb59-87faa7866148", "value": "41b4eb7c12331a5ff00a984ecb434d03", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689749814, "uuid": "d1d5093b-ffae-4645-9c82-4fcecce9f47c", "value": "3072:GdfGpGbErLo10x6Qzeqa5lFMVqqmaOEFA+Ap4qsgW05ytrZCos:UGRLo+x6YIKnYEirsgW7e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689749814, "uuid": "9af0b9fe-dd53-45a8-903f-707ee4a37d6c", "value": 304128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689749814, "uuid": "6d4acb6b-bbef-49a9-827f-cbfbad0fd3eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689749814, "uuid": "6d4a89cb-d1f2-40a1-91ba-0bf308b9eafa", "value": "9c72d48f384e384c0e3b159f4039298f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f456b1f-25fa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689746696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689746696, "uuid": "bfc7d43b-429a-4a19-93cf-0955d6a026ab", "comment": "Malware payload (AgentTesla)", "value": "c9ca9b64c5afd8ff22c00b717966283e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689746696, "uuid": "ece81b0f-82cb-4ba9-bb06-d471580d697f", "comment": "Malware payload (AgentTesla)", "value": "534d886457262e8dc1404e90dfaeeaff40735767639e044bd116b0adb93207c7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689746696, "uuid": "0dc76c78-6b05-465c-b54c-393d2cce9d99", "comment": "Malware payload (AgentTesla)", "value": "5cb4d75273e4ad6c104a63c554dcc5c573897b32", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689746696, "uuid": "afa1128d-787a-4ac8-9bdb-cd5436184520", "comment": "Malware payload (AgentTesla)", "value": "448148dcd1b5b21ffd2d97a40b4cb4b33aedf3ef7534b27d0690ea30daa4310c8b406b1c0bf94833ab68aab05a2d9936", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689746696, "uuid": "c08c076d-3a35-4ec8-b767-97c040642833", "value": "T140E459BC313877DFCA17C976C8642C60A6E0226747DBC24E982715AFBE1D5A6DE140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689746696, "uuid": "7899d3d9-c961-4f8b-ab81-d0e0a36bb3f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689746696, "uuid": "71e88e04-7344-4d40-9601-a0054a80f3c3", "value": "12288:tiAbPi8NRArMGMz2qoKH2W+CW7e9KVoQwfA+PqTrQaSejL8ZGNChInzbUmU+Z+SG:JziE9j/ya9jFXqTrQaSejL8Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689746696, "uuid": "a31acff7-9b24-4ae5-a203-f04d75a9e12f", "value": 701440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689746696, "uuid": "e68e61c9-993f-4211-87a3-4d1f878f495a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689746696, "uuid": "e0f613f7-a8b6-4b08-b433-a73b30d8d742", "value": "c9ca9b64c5afd8ff22c00b717966283e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d81cffac-2639-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689774037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689774037, "uuid": "1348c003-9da6-4f28-9483-f7258c2b93d2", "comment": "Malware payload (RedLineStealer)", "value": "e26e2788a8d360db7151b88cbc037c9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689774037, "uuid": "fd51e920-eca7-4b12-a2cf-00674bd01b82", "comment": "Malware payload (RedLineStealer)", "value": "535fefad3e6b3243905fc029701e24596461648b1d2a9d254628a31a855d213f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689774037, "uuid": "6af36aaa-6adb-41f3-b743-76b5e13e6c0f", "comment": "Malware payload (RedLineStealer)", "value": "58dd62a2f50a585cb75d9f556b1ec3c1e9bfe584", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689774037, "uuid": "95bbfc8a-1a6b-436c-b966-cb19074fd7b4", "comment": "Malware payload (RedLineStealer)", "value": "9d20d4ee3e8b98f553abd9711116a64a682809b9d37b057a828f4299a0f6839ae408cddf23549bacdcb03ebc81fba543", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689774037, "uuid": "72aedd74-8956-4406-8419-584fa087b052", "value": "T1EE840117BBD84032E8F42B7469F702830B3ABCA15D7D926B3781995B0CB25D4A97137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689774037, "uuid": "889b50dd-0251-4425-be0f-57c9710186ad", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689774037, "uuid": "115d6ac7-ef39-4d73-8c29-4321d22c3791", "value": "6144:K1y+bnr+dp0yN90QELJ8dIT7OueAAkMNizjtcQKlBnq/xUeCWsX/lAhWEFSQz:jMrBy90NJ8U7OuxzEQcQKlBnFNFoz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689774037, "uuid": "1b569cbf-f608-4ce1-99f9-404c12ffef69", "value": 398336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689774037, "uuid": "39f1849d-f7d2-46ee-a10e-68ea79346114", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689774037, "uuid": "5f3cccd4-2655-429d-abef-c866bcba2a84", "value": "e26e2788a8d360db7151b88cbc037c9c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90da0255-267c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689802694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689802694, "uuid": "b2bb5aeb-66a9-46be-9790-bdca171bc5ca", "comment": "Malware payload", "value": "6f0218253cad6fd61fc0af0c05bb288e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689802694, "uuid": "efe8ee2d-7058-4458-9f16-e05c6e26f398", "comment": "Malware payload", "value": "536a452a921a36815515ea3d3227cee6f4f7cc9ae2ac79172b9b445fa7cc1701", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689802694, "uuid": "c311e08d-1757-479a-9527-76b130e025c8", "comment": "Malware payload", "value": "caf5a8769ca8aae889c4f2b5bd557b77e93e5f91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689802694, "uuid": "c458715e-c4d6-457e-908d-c887eefa2ccf", "comment": "Malware payload", "value": "84375450346ce5c2a1948dd9ace79963d4490d347251c34d172d1cdbfd2be92c8e3bd344cc69c2f8480fa243c0a78823", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689802694, "uuid": "dfb6189f-dc10-4aea-96a5-c66131c7bc4c", "value": "T181B412037BE95131E9B51B7058F702930B36BCA25E78976B2795989E0CB36C4783237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689802694, "uuid": "c6f37f01-b833-4bae-8ed6-d6c84f9707ec", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689802694, "uuid": "399ec64b-03d9-4a82-a925-93b2aa143208", "value": "12288:9MrHy90EX+m09cNkzlK44CgBfZYEsQbfy1qfw:SydEDzl3PEhU0+qI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689802694, "uuid": "b5f1caf4-9f54-4ebd-bbc7-11d6511eba69", "value": 526848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689802694, "uuid": "346eac84-aa01-465e-9d76-f6f60e36d438", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689802694, "uuid": "9ef787f2-fb37-4c65-b7ee-0eb4b28bd20f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a87e791d-2649-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689780829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689780829, "uuid": "be5a23b3-ff80-4217-8380-7ef0571cd0e0", "comment": "Malware payload (AgentTesla)", "value": "780aa063c9da33582456aae81ca77cc8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689780829, "uuid": "2147cf34-fec1-4d4f-a243-dcb89893a115", "comment": "Malware payload (AgentTesla)", "value": "53776bf7c5fa91e2914a9ff83a3625d28cd72749d80b2a68a53794bcd3839e50", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689780829, "uuid": "978726e5-893a-4cdf-8f3f-5728474349bf", "comment": "Malware payload (AgentTesla)", "value": "873067d1ce6d5e6fd87a35c3f0f3a8bf61fc3585", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689780829, "uuid": "77c334a1-a826-40e1-9660-f62bc788b708", "comment": "Malware payload (AgentTesla)", "value": "5fcba4453a4d2d959e327e9937c44a748f9c530b5148f529a5e22aff1457c984b56a2c6ef9c8de934fe8e88353da68b3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689780829, "uuid": "cc184275-4657-42c8-8e36-29933e3eccd7", "value": "T17DD41210B6E24E3BC1BB1FB8A58466F5432C0EDA7427D3CE5D4BF599B90A3067704A27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689780829, "uuid": "a3beaaef-02b3-4d6b-950f-0813b586882e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689780829, "uuid": "671efd58-2400-40e8-b1f8-414bf4f8a85f", "value": "12288:YS6ln+flo/XciMvFjmuRSkKDBZl5iV82R2nbOu2akv8/VrqlC0RD7D:hTdCjEh8zHiVLR2bOu2V0VCvR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689780829, "uuid": "b833b4fb-05aa-4221-8f4c-818f049ea95b", "value": 648192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689780829, "uuid": "f574a643-128d-4f24-b729-b8647c3c4eed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689780829, "uuid": "c58aa274-fe72-4197-8fa7-bff7862924eb", "value": "780aa063c9da33582456aae81ca77cc8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "525eeaed-2659-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689787557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787557, "uuid": "1b2ef85f-5af8-4ec8-b7c4-49cea3f053a8", "comment": "Malware payload (Amadey)", "value": "0bc518d770019fcd61f8b2026db429ae", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787557, "uuid": "b6cd37d5-571a-4eec-8ef4-a9734602f124", "comment": "Malware payload (Amadey)", "value": "53de62bfe96016a8303e98a3a9fbaeb60c2f3f007375c348cea2c5d2575def10", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787557, "uuid": "00990e76-0c74-4424-85d5-31f0d65f18c5", "comment": "Malware payload (Amadey)", "value": "3cd54036ee6b74982b1caf523c2cb9585b20f7f6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787557, "uuid": "8aa36c24-4e44-45a6-befc-8a0711d63d7f", "comment": "Malware payload (Amadey)", "value": "34e7f30ce42733445c0505abfd528eb61dbf7d5823be06b6875d10898434d8faa4fc11b6c2f36bc6b886422a70e99c48", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787557, "uuid": "5d2baf8a-b5de-4819-b62f-022c6f6c1c08", "value": "T1C5840202F7D48533D9B527B069FA47D30A3A7DA14C75836B3381AA5A0CB2AC0B57177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787557, "uuid": "bde1ae4a-52eb-41a5-8e7c-400ad62a691b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787557, "uuid": "f3a2519a-8a60-4dbd-b3c6-0a641f301b21", "value": "6144:Kyy+bnr+ap0yN90QEZNK3it+zIBj5DY7MuVD7mSoURMuZT0FN9oE7d1p83xDs5:uMrWy90qiVlY7MsDSSowMuINuEm1C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689787557, "uuid": "c00dec14-0e1e-4733-b80d-936985cf008b", "value": 398336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689787557, "uuid": "7e2efb22-e1e7-45d3-91be-0d199d19a8c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787557, "uuid": "f481d51e-2bbd-45cd-9d0c-9714f445c31c", "value": "0bc518d770019fcd61f8b2026db429ae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d55a3ed9-2629-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Hydra)", "timestamp": 1689767161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689767161, "uuid": "742e5f4f-b85e-401c-9cec-737d36072c3b", "comment": "Malware payload (Hydra)", "value": "586d46e9dc94ab97f99681396ec35db5", "object_relation": "md5", "Tag": [ { "name": "android_hydra", "colour": "#626579", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689767161, "uuid": "c906faab-57be-40bd-bb47-133f950a676b", "comment": "Malware payload (Hydra)", "value": "5423910e5661f922458077a5df7f3a0be81eac76ff644192f4f3693a2fe0ee4f", "object_relation": "sha256", "Tag": [ { "name": "android_hydra", "colour": "#626579", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689767161, "uuid": "202f16ff-9296-4d4f-8bdf-ba815febb4da", "comment": "Malware payload (Hydra)", "value": "d12771d74a080e8d40899093fe0159a96bd6c8de", "object_relation": "sha1", "Tag": [ { "name": "android_hydra", "colour": "#626579", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689767161, "uuid": "2dc01f89-710a-48ee-8c5f-dd5dac0419bf", "comment": "Malware payload (Hydra)", "value": "4b79ae7913d99f104cdf7dfd5c9cbc0c6952f59075755fbcaf956de2507a12e517f13b43922777464f5d8c33e143337a", "object_relation": "sha3-384", "Tag": [ { "name": "android_hydra", "colour": "#626579", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689767161, "uuid": "8d51fdc3-0cc1-4bd8-9710-ff1aafadbb48", "value": "T156163365F2AAE716ECF41BB54EB3D0C2023B9E494E51472B30A8B25D1533CA04FA5F76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689767161, "uuid": "42952196-b343-43f4-9c38-188b63173ebc", "value": "98304:5kRUSd5jCYXjpEj7ClZc+XmGep0DIOH19pTiUL6puibWDf8qM4:oUSd3iqbV7PVbU8iWDfXF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689767161, "uuid": "6e76144b-576a-42ec-bc72-4ee48516041b", "value": 4257723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689767161, "uuid": "0024aa99-a62f-48ed-80f4-bb2e215e1bf9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689767161, "uuid": "24978459-798d-48d4-aea6-ecc8b7b6dfe3", "value": "d12771d74a080e8d40899093fe0159a96bd6c8de.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d88a8c8-2685-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689806366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689806366, "uuid": "1fb4dd2e-4590-4870-b539-0653151e68f5", "comment": "Malware payload", "value": "b938598941bc685645ce1a2f7ae93e86", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689806366, "uuid": "4e137375-dc00-4cb5-9190-ebd12128c7b9", "comment": "Malware payload", "value": "544e42d33423d4dc27edf3acb6edc56c77346e833a71b353c393e5bb7f8ccf85", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689806366, "uuid": "53ee5afb-65a4-4f83-b08d-03cfbc367a95", "comment": "Malware payload", "value": "056bb6dfb1f8223eefdb786d9d346766ed0ee98d", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689806366, "uuid": "565c79a4-78ca-408f-9f6c-9d5644b29f0e", "comment": "Malware payload", "value": "c34f9b8ef427a8305061168e3c46a595ec3a2f4066c1342b0a1553145c7920001f8a2d08032130e2109ef1bfd96d2b2c", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689806366, "uuid": "050f98ad-356b-4eae-9b6a-7c14870cd850", "value": "T1C3A6330112544173E06E5EBCCAB36A03D6E06C216AB38697397CB56DEB34ED4ADD1BF0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689806366, "uuid": "34dc4db4-ffe1-421b-8c43-5ffa90d29ece", "value": "35a81d16af9f2ba6d515f11152d0364b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689806366, "uuid": "ac2748fa-97ba-455a-9602-0f023fc01580", "value": "196608:jgULpiWPCJcHhcdEkCu9g2LCseyu1WjUee7DJiSn616R/K:jt/icHhcd1C8ayu18U961r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689806366, "uuid": "c6511c3d-842d-4a1d-9be8-ab15900ac0ef", "value": 10237128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689806366, "uuid": "3b046db8-1d27-4612-8902-cfa2c821018c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689806366, "uuid": "52c635c5-0d5d-4e7e-baca-d14076c8be87", "value": "b938598941bc685645ce1a2f7ae93e86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19edf48a-2671-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689797770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689797770, "uuid": "e9b90520-7695-448d-8d2e-9f31a6dc47da", "comment": "Malware payload (RedLineStealer)", "value": "380a33366b16a0894082c78984ba8345", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689797770, "uuid": "a92d8c48-e74f-42f6-9c0e-c0506f57c405", "comment": "Malware payload (RedLineStealer)", "value": "5460a1d2c84823a33909daab1fdc811ef8902f88377e1cf46112a9d0cdce6e37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689797770, "uuid": "16b16cc5-adeb-43cd-bf3e-ead9d791a7f0", "comment": "Malware payload (RedLineStealer)", "value": "9ae5f79b7bdc0d1a1141c5a9d318fe8680149e14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689797770, "uuid": "2401e56a-3003-4238-8931-97a79621cc21", "comment": "Malware payload (RedLineStealer)", "value": "df3f07cafa70872679027a3ba2942824f9a19ff1f2d65b8b0d2703da37371a74527178a7765bc2927ad856cf7a1ab3d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689797770, "uuid": "8e71babb-1793-4ff0-acbc-6303291b47f9", "value": "T19D5439407D828456C3097A309349BDA7DA35E0F947C9A94F169A53FE9BC6B30EF22770", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689797770, "uuid": "ae2ca295-1208-4edd-a567-784947ab464a", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689797770, "uuid": "d82aaa00-f718-42f3-b09a-4342c85041a4", "value": "6144:oA4BeDwJ7SRiJVN2FdyxSDQdMP5cIieWIJQjTWuo:oA+z2Xyx7TA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689797770, "uuid": "2caa7d22-ed47-476f-b6c8-bb7759555ea8", "value": 285344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689797770, "uuid": "cecf5172-4dbd-41ce-8e10-5a3ae9d4fd0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689797770, "uuid": "baa8d6ec-e7fd-4f40-84cb-6c3e070f217e", "value": "380a33366b16a0894082c78984ba8345.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "096dd332-263e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689775838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689775838, "uuid": "b9a798cf-940c-4757-9b92-98274c17df1e", "comment": "Malware payload (Amadey)", "value": "30940c24946f655b1badd8508088fa97", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689775838, "uuid": "621b8e1d-456d-4aae-a1e6-a244a0f84b71", "comment": "Malware payload (Amadey)", "value": "562f0db742e6af6f4b12800d3b2b7d918eab8e467b00cf0dfaaf1292452b48a3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689775838, "uuid": "a6945630-82e6-4d97-b54e-1aa8d270082a", "comment": "Malware payload (Amadey)", "value": "f5f40205e5bac70f5b4033a9777de14868b6298f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689775838, "uuid": "63b1efa1-185d-4d5c-911d-7246a1e6c488", "comment": "Malware payload (Amadey)", "value": "62420b4209bb42aa57b0314b54806345ee59c9551ace0a35d7e3956517ef472c4429d075f1c63619b3da4f5f354e49b4", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689775838, "uuid": "94a86106-109b-4bcd-9b1c-642a85f4c390", "value": "T1E1E2F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689775838, "uuid": "a3bdd1c4-fb1f-4792-8cb7-fb84b6df91c6", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689775838, "uuid": "23838506-b88a-452f-ad9d-5f4c77de7b1f", "value": 31304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689775838, "uuid": "bad61fbb-72e1-4688-860f-3a030e2c5cbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689775838, "uuid": "aa65ee91-730e-4946-9743-7f1fd3a2a25b", "value": "30940c24946f655b1badd8508088fa97.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "005c9898-265a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689787849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787849, "uuid": "3e02377d-295a-4825-be49-2e5ba97f471d", "comment": "Malware payload (RedLineStealer)", "value": "dec3acbb764a83e07ae2aac8fa5e1701", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787849, "uuid": "4ca41796-e86f-4043-a43e-b67b3b815ac1", "comment": "Malware payload (RedLineStealer)", "value": "5692d447bbf6256b2bcd4b20b536a9b7725dbf98aaff51e6e0439f5b12f6045d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787849, "uuid": "aeef5838-7a41-40cb-8353-16066f59c643", "comment": "Malware payload (RedLineStealer)", "value": "9517ea9ee4eef816f16611626927326a839d4cba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787849, "uuid": "128a6c6b-563e-4cf1-bd9d-53f344439d17", "comment": "Malware payload (RedLineStealer)", "value": "40923f50bae357d24cf81ba1b4aef9e99dc439efa067b5ce59f6cf277e0e717e9c22467047231f9c0cad07e93ac24128", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787849, "uuid": "cc75b9be-bc58-4ff7-b7bd-db866e81b61a", "value": "T106840243EFE98032D9B527706CFB06930B367DA29D74876B2755A81A4CB3680B931737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787849, "uuid": "18f1d2c5-dcbf-4d7d-adb4-829f4abb1e8d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787849, "uuid": "3c67ce9a-7516-4155-8da2-1a9d2be59883", "value": "12288:fMrNy90E+0JsGbu8r81fIHo9XgypTOMVJj/HfX8:ay9KGbIZlVJrfM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689787849, "uuid": "773535d5-41a4-4a6a-b4ee-946c96dae722", "value": 398336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689787849, "uuid": "5666feec-e5b0-4269-b40f-fe05cb2c4e82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787849, "uuid": "b8cb3438-42d2-4f48-a2c1-852a21004ca3", "value": "dec3acbb764a83e07ae2aac8fa5e1701.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13600e98-267e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689803342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689803342, "uuid": "d99dbc10-3873-46be-bbb0-af708e0c61f2", "comment": "Malware payload", "value": "6f7ba05af0331a3fcf5d4aa6706a4bb1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689803342, "uuid": "a6373022-4a38-4da2-85e3-bf69cc8aecb5", "comment": "Malware payload", "value": "57458f8d04d06b78d3252d2d847c9dff37fece42c7a45ad5c366b5604fe0d37a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689803342, "uuid": "80006fe9-61a5-4e17-b171-8ff1f38320db", "comment": "Malware payload", "value": "117e69bee929589c4c76dd228ae21ce5181ca317", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689803342, "uuid": "fcbd4a90-67cc-45eb-9f2a-f8366eb69a98", "comment": "Malware payload", "value": "aa848a982f4c5faba7c6dd6561d51572221456d2936ef61739ffe04ec9930530735438b37ac8977171c78c8db72bf321", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689803342, "uuid": "144ec586-a0f0-46d1-89b3-64469882e6eb", "value": "T1EC44CF6177E1C072D1636A310931CAA22A3ABC726B7591C733583A3E2F306D15F79B97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689803342, "uuid": "16492960-162d-44f3-9b19-ce38326a9809", "value": "02f23a44e70611470e4c2107da6d7f64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689803342, "uuid": "838d0fc3-287b-4bb7-9840-4110487da24a", "value": "3072:gs3blFBQdqFZLCo0CoNx/sOT8HLF4j6aFqoNP3K4Ait3:zbdQ8FZLCSoNNs+P3Ky", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689803342, "uuid": "d4731855-7e62-450d-bca9-4ac5f865d7ea", "value": 261632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689803342, "uuid": "0be61a32-9831-49db-8dd8-8a3e4f4855a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689803342, "uuid": "d576d4aa-07e2-4704-9082-496ffbce37d1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "486ddc88-2614-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689757905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689757905, "uuid": "48b2a2cc-7dee-4ec3-8dbe-8b6bbf67fcab", "comment": "Malware payload (AgentTesla)", "value": "143e5ade7104769bc90d0a4a3999b82f", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689757905, "uuid": "b8ca8a23-a511-49b2-b1db-a3b2aadc4a52", "comment": "Malware payload (AgentTesla)", "value": "5795aa740cbe8eb85a5a5eb72c76bb67c2a70b787c1b70705378b66512ed2444", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689757905, "uuid": "b6fc47b2-75cb-4115-8663-c1e12492164d", "comment": "Malware payload (AgentTesla)", "value": "c69844698d59de4fe627f7c4b773eae24b694a74", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689757905, "uuid": "7c8d8b7f-96b0-4153-914c-260f4def3702", "comment": "Malware payload (AgentTesla)", "value": "ec136a48a517cd1479c006837837c988bfdcf0f3598e6c4e78cb62c92b1104dd46f136e7112a924bac238564ed23394f", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689757905, "uuid": "a2b594eb-bf7d-4e0f-959f-be374a868458", "value": "T14EE4239F2C31E62595D3D4E892E4A58DDA0E706485BE34CAD6DAC42FCF007C6E617B8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689757905, "uuid": "74943eed-e9aa-4d10-a650-833d1af83c12", "value": "12288:GUdpRGWfswndnRIMVsHQNpWg8hET/YPZlobI1W7u6ziQvqmvhYbY8Z2wkCo:GIzhfLnZbVsHQNp+hOYZ8lusimvWbX0L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689757905, "uuid": "bdb46b3b-076e-4b0b-b4e5-5f021d599b56", "value": 694616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689757905, "uuid": "56a14a33-e5b6-4572-a71a-19a49d3252fc", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689757905, "uuid": "4dfca096-531d-4220-91a5-38b32ad12e3f", "value": "23JS0412-Power Shades wire payment.jpg.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52cf8449-262b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689767800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689767800, "uuid": "f5c3483f-6531-4255-bcf9-c9afc92a081b", "comment": "Malware payload (AgentTesla)", "value": "cc8b5c6e7355e5b3a544c4ab4eb92468", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689767800, "uuid": "7d586027-1629-4500-a855-b917d0f1648f", "comment": "Malware payload (AgentTesla)", "value": "58cc396f4117a043b9aed10f8289bbd51f37404b7e4331b97b97eb7901a76f79", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689767800, "uuid": "7f76f603-ddab-463d-a6fd-08a41fe0b807", "comment": "Malware payload (AgentTesla)", "value": "e8b3b1d2a7dda545733a0e6f5407552afb39b90b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689767800, "uuid": "9295c7ff-e6d6-4d97-883d-e50408f49c39", "comment": "Malware payload (AgentTesla)", "value": "fd668aba334d3c59551c562b12042b93eb73b196adc3da5e57ca21bc057ada26fe547f4f529fec366bae072b8830e079", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689767800, "uuid": "45a82dcd-e56c-40b7-bdbd-56719162b604", "value": "T11494234CACA2AE6B9281CEF5A89FE1B0415CC70AAD791CF2AF75E765339015D0334F51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689767800, "uuid": "be4158f4-d8c7-4fea-8c0d-89ef23f64dda", "value": "12288:MnzN7RmdscqwOTNGbKv6MYRzGGQoL+P00a22jB1wyQbM:mh2DOTwyGh+P00HEB+yQbM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689767800, "uuid": "a43f5557-18e2-41ae-ab02-0999f9660437", "value": 439959, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689767800, "uuid": "1b8d1c78-4dc0-46bf-b2a6-08a4d733c738", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689767800, "uuid": "9bf1508d-dd22-49d5-892a-9b1e225c35f5", "value": "CARGO TRACKINGHBL# PTMYJ2360001.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4982cd68-2659-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689787542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787542, "uuid": "5624cccb-feaf-49e8-bb92-ffb71e6d7b3a", "comment": "Malware payload (RedLineStealer)", "value": "28d3660c5b5ef787497ffb61b19f8e61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787542, "uuid": "48a60cb5-c84e-485d-ad9a-b3a6372a235b", "comment": "Malware payload (RedLineStealer)", "value": "58f6935c15dbff1158f14839ec623027150c9807c5e1aeaaf3896d516c27be59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787542, "uuid": "138cccfc-c2ed-4eca-9eaf-4ff67ae5b3c1", "comment": "Malware payload (RedLineStealer)", "value": "af3674bb9549c5af5b3a156aeb98f2b073b50dbb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787542, "uuid": "00d9b0b5-d826-4304-b74b-37ee1fad9f38", "comment": "Malware payload (RedLineStealer)", "value": "40bb0d0985d827d11c801bbd03a3c1467c9f8230be7f1bfcfa6b91f00a8fc9bace997b36173aa979e205bab27d1edcf1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787542, "uuid": "3fa0324c-431a-4aac-a818-26003b316690", "value": "T15484F102EAE88573DDB567B028F607830B367CA14C39876B2795A85D0CB36D0A53777B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787542, "uuid": "a6e439d0-9ecf-4719-8253-54773a3592ef", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787542, "uuid": "0cea1d52-e616-40b7-af09-b07d18ff85fc", "value": "6144:KGy+bnr+Ap0yN90QErXGkWKjZN7QR5nPl1t7Oack6pfBNEmMXmoA:CMrcy90NmlrVMpNgXm1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689787542, "uuid": "24b77e5a-168e-4eca-b9a1-7a5f9d40b619", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689787542, "uuid": "72b77f9d-d1b9-4d6a-8290-bb772b231747", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787542, "uuid": "23e84d8f-f2d5-43eb-b2f7-3c67e9788062", "value": "28d3660c5b5ef787497ffb61b19f8e61.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4620ed61-2617-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689759189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689759189, "uuid": "52613e8f-9ea3-4caa-ba32-fffb1ab83377", "comment": "Malware payload (AgentTesla)", "value": "df496973de85c89a9601d52af38954a8", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689759189, "uuid": "95ca3cc4-8906-48f1-a222-e4928d81baa8", "comment": "Malware payload (AgentTesla)", "value": "5971ad2461f019524a5b9fba9404a8f8c6c092a4d2334a9d40fbf3f828659ba2", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689759189, "uuid": "67b7e5f8-c3ff-4139-a92e-fdde089beeea", "comment": "Malware payload (AgentTesla)", "value": "64e194dfc685395e8540aea5ae826b82be96afbd", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689759189, "uuid": "1d18ab57-0bb9-46ec-be4c-f329759227ab", "comment": "Malware payload (AgentTesla)", "value": "79c8eb768a95d7252e8df83e42222ebb9ae5a99496449268ae659cad050a135d812e3fc2efda698d293f4ff01a4e9037", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689759189, "uuid": "d1581428-54c5-4a4b-97f7-e41bf7a438c6", "value": "T17DC4233E845C8DD5264A613349012F3D179F783EC6ADE722C7EA38036CA9B7E6352463", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689759189, "uuid": "df42652f-9309-4d11-b4a3-d1d6741e6d4d", "value": "12288:12eO+7GwjtpRJdaREzan1RltUGh6+4gCL7D8Cj6rCYARPypX:1XGwn8REg1RlhQvhN1W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689759189, "uuid": "a6d7d5a7-4a2a-4612-a6a6-d35b896521e6", "value": 595001, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689759189, "uuid": "2e2ef5e7-3cca-40a3-b6fa-fbea65a1ba08", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689759189, "uuid": "99e8dd48-22f3-4918-8a03-03852ac50f73", "value": "CI, PL and COA.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6626366f-2627-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Hydra)", "timestamp": 1689766115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689766115, "uuid": "06a32909-baef-4795-a09f-1723c52dfee9", "comment": "Malware payload (Hydra)", "value": "735f870182d4d3334d9f8bec289d87e1", "object_relation": "md5", "Tag": [ { "name": "android_hydra", "colour": "#626579", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689766115, "uuid": "15e84c22-c0c8-4a9d-991c-2099c4add183", "comment": "Malware payload (Hydra)", "value": "59bbe02d24b8c0415204e8756e835ce8e97047013299e35e1f85334e15b763e0", "object_relation": "sha256", "Tag": [ { "name": "android_hydra", "colour": "#626579", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689766115, "uuid": "63e6d21d-8950-46e8-84bb-e4e4df24decb", "comment": "Malware payload (Hydra)", "value": "5c816c94aed47593ca5fe543f571ac0768bb13d1", "object_relation": "sha1", "Tag": [ { "name": "android_hydra", "colour": "#626579", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689766115, "uuid": "8970a691-31dc-42e0-8ee6-b76e71354c69", "comment": "Malware payload (Hydra)", "value": "1e32baaea2fb74c0c2e89927d1a1035cd43067fcc1e5a97328b135fcd9754f2b7df81deaabce8744316100711595d303", "object_relation": "sha3-384", "Tag": [ { "name": "android_hydra", "colour": "#626579", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689766115, "uuid": "72c9d5a5-0b48-44ca-893f-86818d9b4e20", "value": "T1F1163300F6E96BC2E5BA0B7189B6828251773D594E33911F3569732C76736C88FC0A6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689766115, "uuid": "eb5ebcbf-082d-4073-995b-2ebfdd57b3ec", "value": "98304:qWXPNi8hQtvritHwEjW2Gsbfdw4N7gTTIBaDuXW+1LvwQs9NdIK+H5:f/EDitWsbFRNdwHOVYNdIR5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689766115, "uuid": "75be5498-727b-41c4-aa2e-de7317dd2506", "value": 4044435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689766115, "uuid": "184a3b27-94f1-4d85-a374-3f1c95545926", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689766115, "uuid": "7518efe9-9dfb-43f0-849c-d72ca0d916a6", "value": "10-aligned-signed_en.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d8ca749-262f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1689769563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689769563, "uuid": "39ff9a27-22ce-4767-9488-2f29a6639baa", "comment": "Malware payload (Loki)", "value": "079d7214ff7a8249318e5f532acd2baf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689769563, "uuid": "f11436dd-d703-4561-bf50-3b2196db917e", "comment": "Malware payload (Loki)", "value": "59bfe87a4f70ad80b96e5d135d9688324b18009f800b7001c6efa116fb780d2f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689769563, "uuid": "28bfc2c8-cf1d-4da5-bf96-e9932ae99365", "comment": "Malware payload (Loki)", "value": "ac334f7093976b4201ed06bcf04717075af5a61d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689769563, "uuid": "7e9f550d-5ffd-4930-9ec4-ac558a7203a7", "comment": "Malware payload (Loki)", "value": "6137a3fe0553fbbcb00f7f8edcf1c55a62b06591ac3bac2b09a5eabd8439917ffa4bc571fb9edea91dd9e9e19c71b0c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689769563, "uuid": "bf1336e1-2ee0-4b55-acb3-9aa517a3f250", "value": "T183B423B0C5EC961BD0E189F80BE3E74425A19F911A29C15D9E8FFCD8B9E7781520378E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689769563, "uuid": "c2a10fed-7a9f-4233-8859-30a7afcb24fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689769563, "uuid": "53ae376b-ac25-4657-8f61-04a897dcd60b", "value": "12288:7fb/WT4UkuZbNjYuEnPI9dCZ3Un98ukd+0wnPo9vpymW2gFggBEI:7fzW/ZbN0wuxduPoNph8Fgg+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689769563, "uuid": "be294523-2c44-48e4-902f-d0601cb714b9", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689769563, "uuid": "83d65234-9288-40c6-9f5d-fb1c3ab878ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689769563, "uuid": "a3889f68-2715-4982-9908-cf57daeec226", "value": "kellyzx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25344b3c-25fb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689747108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747108, "uuid": "b08ac8bb-d832-48b5-b19e-b1f0d176d5ce", "comment": "Malware payload (Mirai)", "value": "bd25c40f6f90b08f622ab0f1e6f03884", "object_relation": "md5", "Tag": [ { "name": "2-59-255-213", "colour": "#A4F8B9", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747108, "uuid": "2f7152c1-6819-41a7-b6e2-c6ef1ccca582", "comment": "Malware payload (Mirai)", "value": "59c63c587036ccb6eea23990757be32f4ae3ca1d3558ae33b9e0fa21c1b49921", "object_relation": "sha256", "Tag": [ { "name": "2-59-255-213", "colour": "#A4F8B9", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747108, "uuid": "20750b32-bb3a-41e2-8866-ca4f25ede0f2", "comment": "Malware payload (Mirai)", "value": "af0301c85faee3e50217ad3711ca9720ec001c9a", "object_relation": "sha1", "Tag": [ { "name": "2-59-255-213", "colour": "#A4F8B9", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747108, "uuid": "88014a60-7144-436f-af56-4fa4bb122a23", "comment": "Malware payload (Mirai)", "value": "9d928b42969ac4c4d7abb45ee605523f74145fe1dd8ad4729ce1b3a9388578495c4440151ff9a2cb421edd104700f191", "object_relation": "sha3-384", "Tag": [ { "name": "2-59-255-213", "colour": "#A4F8B9", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747108, "uuid": "844a8b96-4236-4279-9915-00dedd9a0a9a", "value": "T145633BC67412AEBDFACFF57D85210E09F821622150631B27B767FD93BD730A98909E06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747108, "uuid": "84e48bbd-5d7e-47aa-be31-c5b99e662309", "value": "1536:EngadFQXQ/rkmpQ7QpWg1p35+KVl2bUmTq+nrCn8ID:XatpPp35++8K+rCD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689747108, "uuid": "fd3ec870-ebc3-4991-8931-f97a61a3f00b", "value": 67480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689747108, "uuid": "e995dabf-ecef-47a2-828a-411d43edf9b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747108, "uuid": "9ea4d381-1e1f-462a-a9ab-0dc88e2a5b19", "value": "sora.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b770805f-25df-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Fabookie)", "timestamp": 1689735328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689735328, "uuid": "00bd4363-77b7-4230-9eee-dbd71d975776", "comment": "Malware payload (Fabookie)", "value": "67b686ee5be221f1b9160df65013c816", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689735328, "uuid": "5a7a167b-ac12-42d3-b029-05fc4d692ce0", "comment": "Malware payload (Fabookie)", "value": "5a2aab91f845ded0a2121f0700f8e954033e1b6eb420cd8732f170dcdf6d0adc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689735328, "uuid": "e1e159e2-d99d-4433-a347-a54c0bab3c9c", "comment": "Malware payload (Fabookie)", "value": "62cbd1a22ea9e5e7b0449eb2c12408b5616a215b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689735328, "uuid": "7737c6fb-23b6-4c33-b20b-837075c24ff8", "comment": "Malware payload (Fabookie)", "value": "d0a988a02c1c169de8a49844fbeb3d21702b03c34a72f6b4125816cfd66f10e98eb0a9057c2074aa8d15a3b0d324479b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689735328, "uuid": "f873eb22-b225-4243-9f3f-206d1119be30", "value": "T186D4DF81B39095D9C4B88430C693CE71CA317C64DB28569BB6D4BB6F2F32AF1653731A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689735328, "uuid": "21839bcd-f099-468e-972f-76da579584b8", "value": "4673ad56625d375f2efee239af061364", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689735328, "uuid": "11d10aec-ea7b-41ff-82ce-dd0a5b67c25e", "value": "12288:G7bBw/jvHx8Xr3lRkRc4YFwjsWOfRg6gtPbcTTn7qxerx7:qS/rRWr3/kRc4l6g6gtPbcHn7q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689735328, "uuid": "120d08ad-15f8-426b-a474-6ec9dd1b6454", "value": 606208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689735328, "uuid": "70fe8656-6f96-4f2c-8e7e-3fc9867b83c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689735328, "uuid": "0b856bb0-ab89-4fe6-a487-fd81b5881048", "value": "aafg31.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2618275-2634-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689771934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771934, "uuid": "fa531dcb-23e9-4e50-9a2d-1a314130288e", "comment": "Malware payload (RedLineStealer)", "value": "32ab0711c74737a7d5948b73ccc1ab6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771934, "uuid": "2d06bd55-da11-4338-bd5f-a5edfd6d8590", "comment": "Malware payload (RedLineStealer)", "value": "5a9212ccca92111e18358da4163f1a5d4c12debc5b1d9ac429198c7ad68de5d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771934, "uuid": "d6d21cfd-a013-4ee2-9e7e-821520407daf", "comment": "Malware payload (RedLineStealer)", "value": "3bd68e686a0260a11aa4805a2655867c4e780059", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771934, "uuid": "905b57ec-f7dc-41f8-902a-08159dde8347", "comment": "Malware payload (RedLineStealer)", "value": "e1569b499ac8c8f7550e19a01d9c9f381e16cc25d29a0b3b3fa7bfcba8e546dbe4d6b7f22348a7ca8d7745680227fb69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771934, "uuid": "544fe3ea-ffd6-41b0-b796-6d7e5d8a2391", "value": "T10BB41202E7E84476EDB917709CF712D30B36BDA25939833633512D5A0CB39859A32B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771934, "uuid": "a0241590-31ff-438e-b0f2-ba1e920a1fc5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771934, "uuid": "7a4600a0-2d00-44f2-8bba-a12a7e49f221", "value": "12288:8Mrzy906i3DhgK5RE1g0xJF7ceeeeDC37Ztoj8QXII:HysNDSF7we97Zc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689771934, "uuid": "3d52a64c-732f-4273-b1e9-eb4346cd2c67", "value": 526848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689771934, "uuid": "2b20eedd-1fe4-437a-9123-46c474ddec81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771934, "uuid": "f6514d2b-f528-42c8-afcb-b49b12e12a68", "value": "32ab0711c74737a7d5948b73ccc1ab6f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd1df013-2617-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689759496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689759496, "uuid": "d75e03d3-bc3e-47b7-918d-f99071645c70", "comment": "Malware payload (AgentTesla)", "value": "7130323d47582105b63d8d1971b3a5a9", "object_relation": "md5", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689759496, "uuid": "1d9e28fe-cf4a-4ab4-ac82-51139989f24b", "comment": "Malware payload (AgentTesla)", "value": "5ad0cd5206fe38b0cbbf60bb61748b528ff4997cd35af6e319d1aa0ddca6ebac", "object_relation": "sha256", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689759496, "uuid": "9a0d3afd-06c1-41d2-94cd-85a5e44eb418", "comment": "Malware payload (AgentTesla)", "value": "6038966bc19f2e49fdd851b9c8a158d0c49e2edd", "object_relation": "sha1", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689759496, "uuid": "3a1db9c0-3078-441a-99ee-7c7360ca9051", "comment": "Malware payload (AgentTesla)", "value": "23cc5da80410e20628f45fe3dbf7c844a343dc478ea0012c015f2894caa1b1bae4ef1db479b5aec411dc42e222b9ef53", "object_relation": "sha3-384", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689759496, "uuid": "548a7d90-608a-41be-ab63-b03b75e4d1f4", "value": "T1F6A4230137FE369E5E1D42D99AC3AA2E4A31C3D5C053FAEB941D5448388EB40CE5DABD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689759496, "uuid": "c85b7f65-220e-4627-9909-1d4aaa02505b", "value": "12288:LHjP5AOAndxG1cu655evnY7iBZc9CNVk534qYJc/u2iuabc:LjGSG1XQut1X21ud", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689759496, "uuid": "0c926e21-9396-4c3d-b6c8-5cb84d4640c7", "value": 454864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689759496, "uuid": "03550ad0-94cd-45d0-9cca-bc4bbd2b86cd", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689759496, "uuid": "1fcf443f-569a-4164-aa89-11ed779a4c74", "value": "Remittance slip 060223.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adece02b-2682-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689805320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689805320, "uuid": "8893ea95-cb40-47cf-98e1-203413f34cc3", "comment": "Malware payload", "value": "8ca8d502266f6b15b5b386fece5d7c66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689805320, "uuid": "afedfe27-2742-4c12-9d37-83aafba0e4e3", "comment": "Malware payload", "value": "5ae7320bd89c825ed9335fd5ff35cd53997d7dd6023818080c1f01d6cce20527", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689805320, "uuid": "b8638f7c-cd16-4249-91e2-39617aa60c7f", "comment": "Malware payload", "value": "da3118918a2c4d445259126690d4f773a37ddecf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689805320, "uuid": "221194ec-ff53-4adc-bfc9-19197f2b851b", "comment": "Malware payload", "value": "8931776a519c40164166e5da69210ad85d09da72ed0e861e36144df98716878de9871ed411d1b3e1a2c0a449bcea5034", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689805320, "uuid": "a89c2107-ec68-47d4-8615-288c4beb5bdf", "value": "T142E25B483BE88327D6FE2FF229B291010275D507D923EF5F4CD885AB6F67A8146013E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689805320, "uuid": "b1a99b5e-b094-4037-856c-464c167d6c51", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689805320, "uuid": "0cfa8fdf-bc05-4f37-be3d-677af74aacca", "value": "384:47wTA+5OfPgEBQqWvfcQLZe3sw0hYACSqRDTnY2uRugtFuBLTIOZw/WVnvn9IkVC:KrgECfLHwMYAoRDTY2uBFE9RlOqhnbK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689805320, "uuid": "e318324a-ec16-4186-8442-b77815819d54", "value": 31232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689805320, "uuid": "a47de396-592c-448c-9fb0-6351b5a6d2b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689805320, "uuid": "f8a0b10f-619f-47d5-b6d0-a4c91dd42deb", "value": "KSRISMYBABY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55ae8d1e-2671-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689797870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689797870, "uuid": "e7d15b5e-f318-48de-a191-426df5c98c9c", "comment": "Malware payload (Mirai)", "value": "23f982e7934a9192ca8b58638ca3893e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689797870, "uuid": "851b7709-c8fa-4e3c-b28c-0fc73697026a", "comment": "Malware payload (Mirai)", "value": "5b2ace1f6166c842dc8f1b0bdcfc02bdcd3aa47976ae3dd01c9c6e782dfec557", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689797870, "uuid": "be326a78-6b80-4384-bb3e-3d2f4a0b3049", "comment": "Malware payload (Mirai)", "value": "1c217a17c58ee57a768508ba758c71087af996fb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689797870, "uuid": "7869a3c4-7b12-4ba8-bb65-143666b8ffe7", "comment": "Malware payload (Mirai)", "value": "c91d2a0f23f26c296a65db848b77fcb7d03e1c1058f20d57edd001bbefee03f01a156e87221e7cdc19794fe8c48577a7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689797870, "uuid": "cc6f5052-b874-4f0f-ae63-303acd21ee3a", "value": "T14D333BCA66022E2DE5D65CFD80734F0AD9542711A4A3172BB3ABFDC339332A4FE55909", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689797870, "uuid": "e03bda7c-1d77-4187-a253-0b99d9dbb3dd", "value": "1536:r8++P91trZyUr99C7ZQSD7cuMKg1pXSKRZ:re99KEuMTpCKz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689797870, "uuid": "50997e97-0aeb-481f-b002-e73a1f4bd68e", "value": 53620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689797870, "uuid": "966e1add-f49d-4352-8f76-809b11f56abb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689797870, "uuid": "b37ebdfd-617c-47a0-823c-106c380c4d3e", "value": "23f982e7934a9192ca8b58638ca3893e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b3a6b85-25d3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689730046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689730046, "uuid": "0bf00600-e75c-4e25-a01f-453a3d84bafe", "comment": "Malware payload (AgentTesla)", "value": "5292568ecc2adac204dbf12e25b55504", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689730046, "uuid": "3ab84fe4-4bd6-47d7-8d87-732800e1ae30", "comment": "Malware payload (AgentTesla)", "value": "5cc53602db09f6e14da3a1f8f6508649dc4fed90cbd6782b61d16d2600f61daf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689730046, "uuid": "11f0bd9a-a9f4-4380-840a-a34c0ac4ae12", "comment": "Malware payload (AgentTesla)", "value": "af275f86284d2a5dc24cbfd5be76159a9cdb2bdb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689730046, "uuid": "1ff55211-025d-475a-ae65-4a24c251c13d", "comment": "Malware payload (AgentTesla)", "value": "632ad44eedca8ef3f9bb3f2df515608f95451b5d97229725b8e2749619eb9a6adfdb2dfbc0a629c9a3eae2a0869a0dca", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689730046, "uuid": "cb82fe96-3e27-472c-9707-1bcbf113f523", "value": "T1C0D422985298C733CDC95BB4A3A2B79663B09FCA1452EB8C4F86FCC2F457344529253B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689730046, "uuid": "450c9967-4406-40b3-b0d2-345f47b347b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689730046, "uuid": "9a45fb4d-8b01-4099-a720-355617ca9c3e", "value": "12288:0PYPfY76xQ0EcTkGLZ4tNss2EDUmqHq+Ujp5nqBuuoFq8Yrio25G:0PYPg2DEcHN4H/UA+Ep5nPV8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689730046, "uuid": "289cf9ae-f9e3-423c-96a0-34ededbe05be", "value": 638464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689730046, "uuid": "65969d52-1666-48c7-9ed7-aee11671198b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689730046, "uuid": "4f291350-19c5-44b9-a465-5ef216caa876", "value": "SecuriteInfo.com.Trojan.DownLoaderNET.666.6402.6215", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62931999-25e0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689735615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689735615, "uuid": "2d3dcf52-f3bf-4c04-b219-85a55737ef44", "comment": "Malware payload (Amadey)", "value": "3b6d5340e67ea7f08a05b76d389d92f3", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689735615, "uuid": "9ed2b5ee-1fd2-4c44-824a-9610ab4ed3ed", "comment": "Malware payload (Amadey)", "value": "5ccef3f0358cb29eb43fb88cf627fd3a87e69cbc3062d53955a8c0b98e83ef3d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689735615, "uuid": "a9cc1c9f-eca5-408f-bfab-35235cc8b04a", "comment": "Malware payload (Amadey)", "value": "11f2720f11ac10eeb33f772dd338ea42850729ca", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689735615, "uuid": "76aee905-8170-4296-b646-b035c51172b8", "comment": "Malware payload (Amadey)", "value": "633e34994fa0b493aa228a12508a1b62fac31fd89f1977ee71eb9430f0c454f1cde0d946d69d64e47ca3eb135fe3147f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689735615, "uuid": "224c2fcf-f76b-43d7-b783-5a3b2d84a822", "value": "T12C34D013E7D88032D8B5177058F703D31B36BCA1AD78836B2785A95E1CB3694A93673B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689735615, "uuid": "0ef8b666-9cb1-4325-89b0-075c60c89576", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689735615, "uuid": "14905651-b466-4c3d-a897-25d313db54fa", "value": "3072:Kzy+bnr+O1k5GWp1icKAArDZz4N9GhbkrNEk11cobU3btQutRCIuN75Xo4A+eSoD:Kzy+bnr+Xp0yN90QEHbiPXq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689735615, "uuid": "d4c71c1e-26be-4be7-99b0-8652d7750b9e", "value": 240128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689735615, "uuid": "4c3bc739-458a-4a96-a90e-9b1e9159f4e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689735615, "uuid": "dd0d4693-ec66-412d-891b-14799d0812cf", "value": "x7387246.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "645ebd61-25ed-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689741201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689741201, "uuid": "b26cbbe9-c9d3-4081-9dbd-12ee3d5284f3", "comment": "Malware payload", "value": "a8c36bd32a38e795ba14e1eaca493e5e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689741201, "uuid": "8c8aa10d-2bba-4064-9bc9-18f11ab6b835", "comment": "Malware payload", "value": "5e24704fc0b435d65faec89da645ae87d36c500e42a2dcde3d29fd268f05b9fd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689741201, "uuid": "f70fd12c-a91f-4fd3-8731-1593f16a945c", "comment": "Malware payload", "value": "e9e07f89ceb957c7a34d83069999f7cae6347b47", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689741201, "uuid": "99f649bf-568e-421c-b69c-0c7ca33cb09a", "comment": "Malware payload", "value": "b01f6a1a5b5bb2c2bb3f87e04874e90b3c2b04d6609a94bd4d244ecd4901c52b0aa00c5a6bbd9ab71eb196e0f2ead6c2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689741201, "uuid": "7dd7613a-e0b5-4c46-a494-ea09a3b42ea3", "value": "T1F095230179C04AF2E02634735F261F60D5BDBC206F66CAEB7394181ECE664D15B36BAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689741201, "uuid": "c505409f-9020-44ac-92d5-3339e861d08f", "value": "aac51396886833dc961fcd7aab7711e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689741201, "uuid": "e18331a3-a97d-47cd-aaf7-194a6c58134a", "value": "49152:zeMeFLpaQ9xvcJO3bRtYtY0a7CE8Mo4Ap:z3eFhWauY0SIVr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689741201, "uuid": "dcea5cb8-08e6-4a54-b52e-8f5b062e8410", "value": 1902747, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689741201, "uuid": "f26dbfa6-1070-4d8d-a522-aa074f656852", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689741201, "uuid": "ead7f20a-fb9d-44e3-9384-dcefe34a3b13", "value": "a8c36bd32a38e795ba14e1eaca493e5e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f5e0edc-2612-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1689757165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689757165, "uuid": "5a3ea888-c3f1-402f-b907-12bfa4a76b5d", "comment": "Malware payload (Loki)", "value": "2af4495feffcf3892ce0d9f370983475", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689757165, "uuid": "15cd0bdb-b442-43ae-8f5e-1fe8ed689dd9", "comment": "Malware payload (Loki)", "value": "5e3c69ccc5f95f92997110d85a47c5414b170afb6a714e19e5ef02229087e859", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689757165, "uuid": "8e1661cd-cdc8-47a6-abd8-1c9816afd172", "comment": "Malware payload (Loki)", "value": "f90c568ae0b3e95e52b8c03dd251c12b83252fdc", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689757165, "uuid": "0b8c172f-7e18-4691-acaf-7e327c76d1f5", "comment": "Malware payload (Loki)", "value": "42c8f4ed2fb21bb3b2f8ae6d13c3caa930984b8f0772e339922c8ab31f7f92f33432362bb8d02bf76a998bd4637e47b0", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689757165, "uuid": "f2497592-92e0-4308-ba5d-6132a36dab78", "value": "T141B4233153D1FB6FF493A77E8422EA34115BC3114AB1A86EF02FE13991DFEA21861C95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689757165, "uuid": "5c0ab470-eab6-469f-8300-795b10c27b77", "value": "12288:D0BMfSN4ZpAmgjj9y0lDlefxd5VEwthPJrE+ItgofFVv:DIypGJlDQZd7EwthP1ItHfnv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689757165, "uuid": "1ba4b987-893d-4772-9592-69391656dde1", "value": 512438, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689757165, "uuid": "39ab3d0e-ae96-4888-aaec-9fdafe38b960", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689757165, "uuid": "c581e25b-3487-4818-a2b4-99219da9eb1e", "value": "PI-EP 05919.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f43c1a6b-25db-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gozi)", "timestamp": 1689733712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689733712, "uuid": "1a6aa0f2-79ad-44aa-a39d-3370ef5280b1", "comment": "Malware payload (Gozi)", "value": "0f69a35171f141b851997528744c0ea1", "object_relation": "md5", "Tag": [ { "name": "20000", "colour": "#98710D", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689733712, "uuid": "3cb22f87-160c-43bc-9701-fc3a8b8e8c6d", "comment": "Malware payload (Gozi)", "value": "5e4eb4fbc7183914c110b885e7204fa2bed6e346cfe47f5a3ec9600bca7a3307", "object_relation": "sha256", "Tag": [ { "name": "20000", "colour": "#98710D", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689733712, "uuid": "7997cc57-085a-449d-8bdc-cb30053f9159", "comment": "Malware payload (Gozi)", "value": "6c8d5af03cdc48cd99ad53e9af60847231672c35", "object_relation": "sha1", "Tag": [ { "name": "20000", "colour": "#98710D", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689733712, "uuid": "6645b78a-e2de-4279-9656-a155348662d4", "comment": "Malware payload (Gozi)", "value": "ddfa6fe271827999b12afa1182451f0730a2af784352eeca69875e4623d2b8fe5a28a0941211f5ba068ff8633aa2da27", "object_relation": "sha3-384", "Tag": [ { "name": "20000", "colour": "#98710D", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689733712, "uuid": "0831df89-fab8-45e0-b928-441bfecaadfe", "value": "T195C02B9088810217FA4385527FF0608DB4200CAC3CD127A19500AD24004D10C736B3A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689733712, "uuid": "71ca372a-b3fd-421a-9f14-4b06d015dc31", "value": "3:3J3OE8IbU0MjNEqQRFomyViE2J5xAIwLW7W+X3x6QQFIzUv:3J3r82LUUjohn23fwLWSK6DFW2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689733712, "uuid": "018b184a-d3ad-425b-b540-4fc766015e1a", "value": 141, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689733712, "uuid": "7fc8b244-cbfd-4722-995c-cfdff2a979b7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689733712, "uuid": "bba114e8-ac97-44ab-ac92-fca4186d8746", "value": "distinctio.c.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fab6997-2684-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689806155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689806155, "uuid": "0b73b730-13ae-48f3-84eb-415756a808f5", "comment": "Malware payload", "value": "686b1ae81c26335f55c820985810e41f", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689806155, "uuid": "5e4948f1-2390-4fba-b46a-7ff6d6e42290", "comment": "Malware payload", "value": "5eb2cc89a03a665c1f07b3e13d1bd8df386a28ca0950f5ffbcb8d2e5c039122b", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689806155, "uuid": "bf56c591-f4e2-4529-b989-45f7bf919d2b", "comment": "Malware payload", "value": "c1b3c93f36d46eca361bc4da239f718f0e8ee115", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689806155, "uuid": "36a71750-e889-4650-82f6-d8e11f1943f0", "comment": "Malware payload", "value": "48367f3effa6c89804427651d41929d27cb6c05a738b01a3a77518451d38d158279be01bfe51ed173bca9d757d9d7898", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689806155, "uuid": "a8c7b095-4abe-47f8-b14b-f0a0fd853077", "value": "T1F8C49F21B6D6C532D57F0270252AD79B9129BDA85BF280E723CC7E1F0E739C05275EA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689806155, "uuid": "00b8800e-ba28-4bec-b8f7-e0351d18aa19", "value": "6144:N/R+dXY5AJCcrDow+ZsrLg3bmfKlGzIqSqYf+SAOfVKE/M5TiyXIMFOmZciHjuMB:N/R+lY5ATowv43bqKlRHJVa9iyXI3bK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689806155, "uuid": "ca032700-6892-4c4d-a5b6-c1d842b81f13", "value": 595456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689806155, "uuid": "0d27cbe8-ac93-4d31-97a2-49e0219e2eca", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689806155, "uuid": "15111eb2-ad38-47da-9184-3cb518491627", "value": "file.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "671b64ad-2627-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Hydra)", "timestamp": 1689766117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689766117, "uuid": "8ae4a609-2a2b-4a9a-8e40-446a545a3b3b", "comment": "Malware payload (Hydra)", "value": "675ec856ba8d761e56ce593c28b382d8", "object_relation": "md5", "Tag": [ { "name": "android_hydra", "colour": "#626579", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689766117, "uuid": "c78f30f9-15b1-4ea5-9086-1d4f902a023d", "comment": "Malware payload (Hydra)", "value": "5ec3573316546e421eb57d51ba0cff8a901dcd06038f30964528866f67662fed", "object_relation": "sha256", "Tag": [ { "name": "android_hydra", "colour": "#626579", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689766117, "uuid": "f0eaa0d4-0ea2-4ad4-ab2a-ee1078fcb404", "comment": "Malware payload (Hydra)", "value": "d681a3b734ab8d144b8b33087dd2985cf6723648", "object_relation": "sha1", "Tag": [ { "name": "android_hydra", "colour": "#626579", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689766117, "uuid": "9530f49c-755b-4ba3-8f99-d17561fb6c61", "comment": "Malware payload (Hydra)", "value": "4ef0f384c65f92973baad4d4812cc8a787ad1b24876cecfda2cfd5bcde17d13b875767a1bfb9a015ebc795c0d4e5efef", "object_relation": "sha3-384", "Tag": [ { "name": "android_hydra", "colour": "#626579", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689766117, "uuid": "5f373977-0051-45dc-8ee7-72cb24bcff88", "value": "T162163341F0E1AA42E8FA4B764EA2418041757D86CB9D770B3146FA0C29B3DE1CF99B6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689766117, "uuid": "d176447f-1057-4d3a-8b15-bae7e9195088", "value": "98304:QEJklN+K2iCqoSEjvjAioVxNT7yMLBTEI9HJNvjwaGGL8WTpKEk:bGrC9/zjAioVx5mMLNL/wa0WTcEk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689766117, "uuid": "0c336d6d-9f3d-4200-bf35-ea8fd2ab35fc", "value": 4044036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689766117, "uuid": "5ef79d7d-5c75-40a3-b64f-db5c2a3a8366", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689766117, "uuid": "4d5a059e-efb0-4b70-9d64-5bff48fb3bdb", "value": "1-aligned-signed_en.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4106e10b-2626-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689765623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689765623, "uuid": "9262fd62-5746-43b0-994b-c197f69d3fc1", "comment": "Malware payload (RedLineStealer)", "value": "521b294cb79d631ff200859b5d1bdda5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689765623, "uuid": "652838d4-a49c-4a5c-8980-5c4faa6ad98f", "comment": "Malware payload (RedLineStealer)", "value": "5ef439d03df2b38192c5b0fcf640cf06d18f9776ddd47fc6381438a926a0ab23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689765623, "uuid": "ca616e4a-218f-4db3-8666-342090218ed2", "comment": "Malware payload (RedLineStealer)", "value": "f50667fb04ef8f352bbd16013cce2d05659dcf46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689765623, "uuid": "d99edeb3-8eab-4bad-9eee-0ff2eb246931", "comment": "Malware payload (RedLineStealer)", "value": "697782cf80736610135f6dc6b604dadf269be14609200cb00efc6e37c58f4a5e4f2c18e34c26a7fb355ca0162d842d53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689765623, "uuid": "b73b8aca-be82-4e5d-8aea-3ca4094707a7", "value": "T160840252BBEC4032E5B927B018F713C30A35BDF25C38876F2296A85D1C72594A53577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689765623, "uuid": "9ec079db-0767-4636-8cd7-73268bf7d9f7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689765623, "uuid": "dcad0dbe-3404-47b4-af16-b02b2ce39200", "value": "6144:KHy+bnr+up0yN90QEbolPdoy4rb9zCamyctOfYt4tXegiG2NMX0ghRu7QS:xMr+y90OlloyyTuQSQXegiG2CXZY7QS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689765623, "uuid": "29f9f41f-1246-45aa-94bf-9bd7a124d22a", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689765623, "uuid": "05e2f181-f02c-4cd2-824f-5890f1e084b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689765623, "uuid": "ac45a9c7-a942-443d-b17c-98ffb807652c", "value": "5ef439d03df2b38192c5b0fcf640cf06d18f9776ddd47.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58802f62-2659-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689787567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787567, "uuid": "4c479842-b614-498a-9a2c-58fe5fee51d1", "comment": "Malware payload (RedLineStealer)", "value": "8bb664eabc38ffd53505f7e7b072a662", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787567, "uuid": "1d7de1d3-ce00-4a32-9216-07a75fbe80b3", "comment": "Malware payload (RedLineStealer)", "value": "5f1c7c05ef502fa4b2bb54351f0ae38a73d25d728e2aa370e739cced90aefb04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787567, "uuid": "438dba49-6983-459e-a02f-f7f5cc339ca6", "comment": "Malware payload (RedLineStealer)", "value": "ae84a9b0571b339dd74178dd2b5498421d9ad5e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787567, "uuid": "757fd8f3-1d31-41f3-a1d8-7b272d7bd4e3", "comment": "Malware payload (RedLineStealer)", "value": "de273bbfc9ca8ab1bc97176ef885485fe29b2422fd38ed82f41ef9cf5aa6518b6eff27bbd970bdd415a500f4c9f6e121", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787567, "uuid": "dea9f56e-8be0-4392-b995-0814e509c86c", "value": "T1A174E02136B2C032E52B6A3049708E51267E7DB24B7655CB37643A2F6E303D14E7A79F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787567, "uuid": "3ca6ea03-989d-4a4a-a8b2-29e7767ebef2", "value": "a2ee1db05d75ef9143c7e9fac4f021ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787567, "uuid": "3c92730e-7e5b-40d2-886b-a03cfa3807eb", "value": "6144:35BD31XA/l/qyl38yBOoqNLvxBc4pZ/IobPd:JBDBulBl38akvPHvb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689787567, "uuid": "601b69f5-0922-4054-a7ec-284af31cab84", "value": 346624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689787567, "uuid": "5fc0757a-0297-4ca3-9e37-7df4d2cc8667", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787567, "uuid": "6a9f70f6-ce30-4729-b85a-67f46105f9db", "value": "8bb664eabc38ffd53505f7e7b072a662.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cbb143b-25fb-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689747067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747067, "uuid": "1e7218c2-ba79-46d5-9f63-8d061344d0b7", "comment": "Malware payload", "value": "a8ecc970a9dce3bbd32cecf0ed8428a1", "object_relation": "md5", "Tag": [ { "name": "2-59-255-213", "colour": "#A4F8B9", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747067, "uuid": "288cd4e9-fd48-4c3d-ab89-2266ea7d2a68", "comment": "Malware payload", "value": "5f439d47a6e7e090ed0bda57ffcc9dccc21ed977ad06307e9afc2baa3eaa28ba", "object_relation": "sha256", "Tag": [ { "name": "2-59-255-213", "colour": "#A4F8B9", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747067, "uuid": "772cd683-21ba-45ad-b243-33253dfa3192", "comment": "Malware payload", "value": "71726b7927a3fc7744e91a3bd825fc91cb581ec0", "object_relation": "sha1", "Tag": [ { "name": "2-59-255-213", "colour": "#A4F8B9", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747067, "uuid": "9c31513c-6d9c-4133-8364-8fe4a8c76f41", "comment": "Malware payload", "value": "8043b62210d00957d97e67b09b45ff7da13fffec4f5b857add4e31f4b3ac0fa80d32007358edbdc7841423253e1aa820", "object_relation": "sha3-384", "Tag": [ { "name": "2-59-255-213", "colour": "#A4F8B9", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747067, "uuid": "a100292e-44c0-4aaa-8e70-aaf04bdec016", "value": "T11B514F81B26528743EF35E972375AC10B1A4A0216D909D4AE4FEF8F48DCEF0D26945FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747067, "uuid": "5b742ded-d328-4581-8a25-3dfb8b7d9f85", "value": "24:IjwOevaIOednOe7OeBOedWkaUoOexoOexOeMOeF5Oe+MOeytg9OeTeOeZOl:9/FnT5K5o50N5dF7eRe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689747067, "uuid": "8136a3a6-cbe7-4f77-bad4-3b19f2287ec8", "value": 2578, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689747067, "uuid": "9570b662-1629-4ba7-9ae9-4437221f0d44", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747067, "uuid": "45b8130a-2f81-4f61-b7be-2aee1f923a39", "value": "sora1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fc9512b-262c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689768118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689768118, "uuid": "d21328d2-57a2-49a6-9ff2-34671f7478c8", "comment": "Malware payload", "value": "47565d95ed64fb8a22266ea267789ac4", "object_relation": "md5", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689768118, "uuid": "78735e36-e2b5-4e02-8c01-f3d635543d9f", "comment": "Malware payload", "value": "5fa016ba2483a4f09dcd50e7884ef0c54acba44de9882960ddc12c5a5d72e657", "object_relation": "sha256", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689768118, "uuid": "af7f1982-bc06-4b84-b249-86e214e4c2a4", "comment": "Malware payload", "value": "e9af1a4b057af807a648965b2050fcd0e5315533", "object_relation": "sha1", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689768118, "uuid": "fdd583e8-8276-4e8a-b54b-50a38de70f17", "comment": "Malware payload", "value": "06fa2b5604d847f524abdecc7ba3a2fcbd05abdea87cb12bb0037eeaa204cb6213e37d751a055315ca8f88e6af116c2e", "object_relation": "sha3-384", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689768118, "uuid": "1fb1980e-6bc2-4bfa-95db-53fae3133bc6", "value": "T1C0C42316AF064385180EF36068E355D163143E4B3D99E24FBF72D6404B3AAFB56EEB21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689768118, "uuid": "be11d9e7-aa82-4745-9be4-882083eff93d", "value": "12288:0TxM2b0fJfqhPTXHElWF8yfCyZZV2WRhrGz9aR:0TxM4Oc7HTF8yfDZLVryw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689768118, "uuid": "03a106e9-3f62-49ad-af40-3a5784e8079f", "value": 587391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689768118, "uuid": "c9d7bc80-5569-4c4e-8a04-84594316cbfe", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689768118, "uuid": "10cec2e1-4bff-4add-8f7b-9bd5f0fbb8cc", "value": "Quotation2.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bc34d23-25fe-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689748542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748542, "uuid": "4a95eec2-186c-48b5-86c8-666de8a48728", "comment": "Malware payload", "value": "73838d160eb7a23dfc8def07e8db1fa5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748542, "uuid": "ce7a8db4-84a8-4ab4-beda-79f3b3bf6d99", "comment": "Malware payload", "value": "601a2ff4a7244ed41dda1c1fc71b10d3cfefa34e2ef8ba71598f41f73c031443", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748542, "uuid": "858a6e19-ccf3-43cb-923a-e72ea89083ae", "comment": "Malware payload", "value": "0093bba4bfb96261abce3ad49a4ac84f3f719fc7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748542, "uuid": "e2dafdd9-657a-44d3-b6fa-d19685b6f481", "comment": "Malware payload", "value": "660aa978ebed623f56f22622f7428fb7ea823631c22b033b936bb61ac33eb62bec0e68f72fc23e1a7609931844d5cb1d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748542, "uuid": "069673ed-9942-4251-94fd-8eb307d7d49c", "value": "T128D2E1DB037F9779C53111370AA29070FE71891AD6228BD7415A33F618A7F871B20EA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748542, "uuid": "4e761d9c-2b56-4082-9907-8647b56d1586", "value": "768:hdfZf7j5yMScB57CKqKZtTJKQyqY+tyShuGs:hdtZyMzf1ZuQrFTul", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689748542, "uuid": "87c4991e-5b1e-4188-bb51-4e16e0635fb3", "value": 30700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689748542, "uuid": "af34f72d-f1db-4518-a942-5812d9a9afb7", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748542, "uuid": "a991f3f1-c8a1-4184-a810-8f052111cfdc", "value": "73838d160eb7a23dfc8def07e8db1fa5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69af4c15-2627-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Hydra)", "timestamp": 1689766121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689766121, "uuid": "082b4ea8-6e23-44b0-8b76-cd3a0d2fc288", "comment": "Malware payload (Hydra)", "value": "e28ef88e3832187b5dde412e467e1069", "object_relation": "md5", "Tag": [ { "name": "android_hydra", "colour": "#626579", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689766121, "uuid": "d6afde41-a9e1-47ee-80d4-03d279628e60", "comment": "Malware payload (Hydra)", "value": "60a953fe8bb5763758782b87d563a445192a8c1e144edb2ae458d812d9c447cd", "object_relation": "sha256", "Tag": [ { "name": "android_hydra", "colour": "#626579", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689766121, "uuid": "4a7e84a4-39e1-4cf5-93ac-7b97e08d8d36", "comment": "Malware payload (Hydra)", "value": "622da1f9946daac97cbb51141e22ce43115e4ce9", "object_relation": "sha1", "Tag": [ { "name": "android_hydra", "colour": "#626579", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689766121, "uuid": "a983f604-b279-4935-81f3-593798473aa0", "comment": "Malware payload (Hydra)", "value": "2848351491c6fd40bace284a830d8a9b68eace462bfe521e721e740f86c814c80ea491b08495357965aa2efdcba80d68", "object_relation": "sha3-384", "Tag": [ { "name": "android_hydra", "colour": "#626579", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689766121, "uuid": "13f6a05d-806b-4490-88e3-ac8e792623b8", "value": "T1F716336174CC72E9E6FE573CA43B828540777D258F16A10F7089B31E0A3B1D46F963AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689766121, "uuid": "af6044f7-822a-40ab-a1d7-b3a5b789ad62", "value": "98304:NvHUv9wHliroayEjT2k/3fKzicx5GV1GJiF7aQVtuSFR/jFClp3TjE7wU:6dcIP13f3ca9FF3v/jFkZjU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689766121, "uuid": "2af9ec10-4e4b-4d32-8719-b3f4ac1f6137", "value": 4044517, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689766121, "uuid": "4153c54e-cec3-4cc4-8856-e9412e5a4f46", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689766121, "uuid": "74e5e759-df9c-4d47-89e0-3568299238c1", "value": "3-aligned-signed_en.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26e336a6-2675-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689799510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689799510, "uuid": "c793b63e-a434-4168-b0e0-2e25d7b86bf6", "comment": "Malware payload", "value": "b1df41eab6eb342e9526b51d7eb2c55e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689799510, "uuid": "fe1a3f5d-8a09-4b0b-848e-9ac14bb17483", "comment": "Malware payload", "value": "624242f45769b1e6f95fa9cf8509589da2a2b643cd0dcd115e17cf1c43b4d190", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689799510, "uuid": "152e4a10-a868-4a4c-9894-340452e501c4", "comment": "Malware payload", "value": "8c31c5069f484c102cbc622156ca42a4d8ca5c09", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689799510, "uuid": "5c0858e5-e2de-40bb-af2c-bb79d9c2a106", "comment": "Malware payload", "value": "155a0071f5ee464c29a3d9c649395490e312b6be23df10c5ab921ae1e79c103889e0db182d75fd27a807fb9b063f17cc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689799510, "uuid": "fab874ed-605b-47ff-aa12-dcbdc50f6982", "value": "T1F183C09AB7D8152EC04103FE580A431F5135FA92C18BE30B779645BA6CB9B5F0DC16EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689799510, "uuid": "59aaac15-4f73-4ec4-9074-56790dacb54f", "value": "1536:NbeeKg2QEJ6clIDghtHUJwPwx1PCZzxfPxS8GdoCi6ja67zS:pLKg2fdlIDgTUJwPwTPCxS8Lw3S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689799510, "uuid": "3fc54d54-436e-4b0a-870a-cbf610adc9e5", "value": 87272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689799510, "uuid": "170e9f02-9efa-4cce-b44d-720be06d7337", "value": "video/mp4", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689799510, "uuid": "e2cca775-bc08-4c72-8472-0209a7dc5c6d", "value": "i_live_in_your_walls.mp4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5539df0a-2634-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689771670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771670, "uuid": "77ee054b-a152-439d-a706-2f263d3537f9", "comment": "Malware payload", "value": "a1fdf661e8d396c8cd79503ec8fb2446", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771670, "uuid": "3e83373e-bbb7-44ba-88cd-8fec20b8c5c8", "comment": "Malware payload", "value": "62438276280215c2c669a96a791345a0d3322970ded4b729d986ddc3068d9f18", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771670, "uuid": "ef6ddef7-b909-4693-a000-7fb4dfe30d25", "comment": "Malware payload", "value": "32213507aa6c760ac4a6fa041ef92deea67c4479", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771670, "uuid": "aca8071d-e18a-4c86-8b2d-0377a785a808", "comment": "Malware payload", "value": "8fa4132c2ba97f8ed90b313d432ff7636ea467248dbab6f40f09641b751a8afa72324e408d5f9b3f6a5dab9e0c73a1ff", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771670, "uuid": "6c0e3ba6-7bb4-4a7b-b5ce-e4083827e73e", "value": "T1737533494ABF47E2D63E53FFBB961226414F3F42699F83C521811A18FEB6D315B21B08", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771670, "uuid": "f9b381bc-436b-4c47-b043-9e2dde2938e8", "value": "24576:qLECN1JZtVCuMZ9oNELJU28QmjsdM3/6Z9ee8s3caS6/9QIaG2CwfQ/TkplHU9fl:qLECN1JlCuiSNELJU2mTNycylvaG2Cwe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689771670, "uuid": "6ac8e50e-05aa-4b1d-9a4a-4b824d14470b", "value": 1556107, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689771670, "uuid": "108bd1f7-3f28-4d38-adeb-17ad50b4ce63", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771670, "uuid": "cbf6a1a9-a451-4030-962a-3202258755b1", "value": "339_7623_8_YC-790.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bb225e2-2659-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689787545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787545, "uuid": "96ff69f0-ac16-4226-8686-418d078cbda4", "comment": "Malware payload (RedLineStealer)", "value": "89cdfc1ba20fd0bc35bb56ce6c94527f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787545, "uuid": "71959554-6d27-4b4a-a04a-22c1dacef532", "comment": "Malware payload (RedLineStealer)", "value": "62e08aa2909617f096cde8be4d834830bdad6f0907e76c051970413bb9a81571", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787545, "uuid": "ec2ea3e5-ad1f-4a0a-890d-1df08dcca878", "comment": "Malware payload (RedLineStealer)", "value": "8ade187af24b731e949253707b8663fe499b9947", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787545, "uuid": "e61335f1-1a7c-4f52-abe6-ec42cd8bf142", "comment": "Malware payload (RedLineStealer)", "value": "d25e6394a17f28c834b7a37b4a76f6b504c3f03a8df8b2eb990232635ae204a4f803ee0736c9ec4704378d36f4d232cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787545, "uuid": "9008833d-68e4-46fc-acc4-1a3809d5b518", "value": "T175840112ABEC8032D9F92B7028F607D31F397CA15DB887272792A4590D73AD49972737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787545, "uuid": "057b2aa4-5725-4ece-b617-d12bad708c3a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787545, "uuid": "d7b74f3b-e4d7-4e2d-b350-858c2f985163", "value": "12288:mMrJy90uJ//GRw6QQHnNYZiHW8cHnl9brxi:DyrJWHNHHWjH3w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689787545, "uuid": "421117d4-9d65-4962-afb6-c25bc33ec1c5", "value": 399872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689787545, "uuid": "204257c1-1c2d-4ae0-98af-38d9f79f82b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787545, "uuid": "3d20cfd7-c039-4edf-87c0-4ea5e0448601", "value": "89cdfc1ba20fd0bc35bb56ce6c94527f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9114591-2615-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689758496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689758496, "uuid": "b0d82d78-e5e8-429e-af4a-2f622a7db1c1", "comment": "Malware payload (AgentTesla)", "value": "36bcc398f8144c8355d794546a3f8e53", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689758496, "uuid": "9196f8ff-d3f7-48d4-adde-2623c9807c29", "comment": "Malware payload (AgentTesla)", "value": "64e16127d298c57d3dab2220968103332cce3f104638cc8556a6cb772ffa0619", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689758496, "uuid": "511680cc-6e00-46c2-896b-6a05439867a5", "comment": "Malware payload (AgentTesla)", "value": "602194ca564b54587ceda7e4417eef8789dea6a5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689758496, "uuid": "18e7d858-5c1c-4702-b0f6-04adcbe6574b", "comment": "Malware payload (AgentTesla)", "value": "5485f0154c3b710af79e68db00cd929d9b916ce53fd527768ecd16bcdf624d864498c1816fb68c17ad30ff39cf705e31", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689758496, "uuid": "414b7251-5deb-4791-8091-ff36d28514f9", "value": "T1C2D41294B2D8C617C5FE17BD6B6167045B38BE937422E50C1F87ACC679ABB414A08F23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689758496, "uuid": "6d36a4c3-4c07-4220-ab2b-0d9803331a78", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689758496, "uuid": "d85d7f7a-5809-4f2d-870d-1f96df0a3cc9", "value": "12288:X5PYPfY7t3cl6u8AktIGyWuAUBk5FuZuqdMftMzOPa:pPYPgNwtG+r0F/qdQMz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689758496, "uuid": "2188c21b-df57-444a-a8b4-4c110f0e9989", "value": 647680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689758496, "uuid": "6ba6a535-0dcc-47fa-bfaa-37cc76280681", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689758496, "uuid": "bf7629cd-594a-444f-90c0-60ad5cb4b136", "value": "Payment Ref[GLV12567196618420067.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91551e2b-25fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1689747719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747719, "uuid": "28c1d908-49eb-4b3a-b0ae-9d84deffa04a", "comment": "Malware payload (SnakeKeylogger)", "value": "5c51af75d9435cc14972dc5bd6bbc127", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747719, "uuid": "cfc1fb30-a30c-4ce1-83d9-3de481172518", "comment": "Malware payload (SnakeKeylogger)", "value": "653712fe2ab77c16473454a92a6ee7200e7c9600262bbb24e14612bdf393185f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747719, "uuid": "c7eaefa2-995a-4624-97f4-56c5c8196ec2", "comment": "Malware payload (SnakeKeylogger)", "value": "2bcaf5781fb1abdd7b295ef32b6bc11148281a4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747719, "uuid": "90301fde-bf26-47e9-8993-47e60bc0c0ef", "comment": "Malware payload (SnakeKeylogger)", "value": "f98809553be73b5f2b7e4aeb57c594d61d303034134c438622df228733541bce44b16317e37b5da81804cfdeae6a7b8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747719, "uuid": "c0b023b8-adeb-466d-b153-c2ed55af6107", "value": "T15DD4019876898657C4FE0BBA6B60570853B86F892423F61D4F93BCD9347BB805E50F23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747719, "uuid": "330a22b0-9ad0-4511-988a-0192e4a7e44b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747719, "uuid": "53a5f993-3428-4df4-bca5-cce733e09498", "value": "12288:2PYPfY7l4NDVZmH3Pq5kWxxtFEaDlZOeGyn4PJ6SbG:2PYPg5D/q5kktFTXnac", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689747719, "uuid": "f5a70a0f-e94b-4b90-ad77-0e86d054fc63", "value": 607744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689747719, "uuid": "72b64808-c438-4eb3-b5f7-df4ab5103a72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747719, "uuid": "507ef01a-3b68-4f5e-b0f8-a6fb60faebf5", "value": "detalle_transferencia_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4740cfe5-2659-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689787538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787538, "uuid": "b5095368-c74b-4ea1-b828-3d7ae8b1a954", "comment": "Malware payload (Amadey)", "value": "105d5754387cc3a3140ccc8660c1e50f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787538, "uuid": "2e5df7e2-7f5a-4091-a653-e2e37e219547", "comment": "Malware payload (Amadey)", "value": "654aa4d5e8d49043a4c5b40ef9c1b2fde8bd371386fd43ed6b7c1d719f41533b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787538, "uuid": "b68e1a78-9581-45ed-bb0a-6a3d0b36c49f", "comment": "Malware payload (Amadey)", "value": "8dbb756c10678900b0e33893e81976f82ca0b8b5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787538, "uuid": "6cba3a2c-fe7d-40ba-ae18-4163b7068db5", "comment": "Malware payload (Amadey)", "value": "2bd67c86bdbae4ec165c8731d685e1b44f363cc50a29668ab12420d207e5c65fb0840c626d31148dddb8c212f27d5cc8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787538, "uuid": "8b80caf4-d217-4103-ab03-241d051d8511", "value": "T14BB41216AAEC5432E9BA57702CF603C30B367DD55D3483673788999A1C73A84BC7236B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787538, "uuid": "9ee94931-44bc-4959-b048-9e894dd51795", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787538, "uuid": "100a98c8-9334-4ef4-b8ef-1a53c779f6ff", "value": "12288:bMrzy90w4dJ/YUR/O0OI/gbs/YYsDYHHlhctsY6Zqztn7Q6ip2:gyV4DHR/VO+/YDknlCtf6ZaV7Q6iM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689787538, "uuid": "643e7c6f-3a7c-4534-a400-f4e84c8ecf93", "value": 527360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689787538, "uuid": "a62672fd-3907-4cd0-83db-926b02c5650f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787538, "uuid": "8fcad07d-1ebd-4f81-b8ab-8f84305e118b", "value": "105d5754387cc3a3140ccc8660c1e50f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fce970b3-2659-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689787843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787843, "uuid": "ecf4db3b-2f41-4532-82a5-22dfb54269f2", "comment": "Malware payload (Amadey)", "value": "1c5eb258e56bf920b56383a4d6f16af6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787843, "uuid": "6c3554fc-5240-416a-90a5-a7b44d378acb", "comment": "Malware payload (Amadey)", "value": "66004e4317e2780ef0d3ef003f57c9acef202ef30e62216a1e839fda5632cbd4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787843, "uuid": "13645d6c-0c35-47a5-bab8-5db87202a70e", "comment": "Malware payload (Amadey)", "value": "0240fcd3478687b9ef092664a93f7f0f3083b6fc", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787843, "uuid": "a3d54e66-ad93-45f6-bd12-621e2fe476d5", "comment": "Malware payload (Amadey)", "value": "a5e97c422f2010301c34d23229c98c5cf068879497bed15d56ffb8309ef25c88ddc3cad16ef6967b07a5123da7137b7d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787843, "uuid": "bb1f4371-12a2-4d93-92b9-c638ad328add", "value": "T181E37C1575C080B2E563283257A485B15E7CFCB00FA6BDDB2BA41E7A2FB04D1A634DE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787843, "uuid": "b634dcb7-6920-4838-8177-412bd529135a", "value": "dcff091e2e9aba82a244d7ff6e487382", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787843, "uuid": "d0d0acea-190f-46e1-9abc-2f3db989b02a", "value": "3072:KlZ3TFfpCRzzwQjiRb5welYpK23rlx4cLXfHXW:er8LjiRVwz86rPXW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689787843, "uuid": "b451181a-7904-4872-a9be-e1a57f8a45ed", "value": 150672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689787843, "uuid": "9841c054-bb9b-4e71-a028-e64961340305", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787843, "uuid": "778d6541-6b59-43b6-8b40-70e11b6d5620", "value": "1c5eb258e56bf920b56383a4d6f16af6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4501d03-2629-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Hydra)", "timestamp": 1689767159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689767159, "uuid": "6feae1ef-e86c-43f7-8482-d3b2d11cea28", "comment": "Malware payload (Hydra)", "value": "6bbcfa6e0e7b0a16f7f2c879154e5a72", "object_relation": "md5", "Tag": [ { "name": "android_hydra", "colour": "#626579", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689767159, "uuid": "9ea4bae8-5092-4b8c-92ea-ee1bcce16f78", "comment": "Malware payload (Hydra)", "value": "660f04e24e94d139bf7b3bc913dc02b5ac4a0e9e358229e4ef2d90528670efd6", "object_relation": "sha256", "Tag": [ { "name": "android_hydra", "colour": "#626579", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689767159, "uuid": "b6956a13-08a8-4594-b7e5-bfa34cea74c2", "comment": "Malware payload (Hydra)", "value": "c1395d15e10b5adc217126a6cd8cf7a57f778248", "object_relation": "sha1", "Tag": [ { "name": "android_hydra", "colour": "#626579", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689767159, "uuid": "72ccafd1-bf35-4b21-9c99-b6742cab8895", "comment": "Malware payload (Hydra)", "value": "39d4095354052af06be599c1ef2167a538a989afbc2827e21541d3ed8f54b2628d900af87297f8d098ae38aa85e78799", "object_relation": "sha3-384", "Tag": [ { "name": "android_hydra", "colour": "#626579", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689767159, "uuid": "cab8a21f-b742-44f4-8fd3-fa2633a24287", "value": "T12E163349F2B41ECAC978AF3849E7518A01236C069F26121B30A9336D64335E41FEED7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689767159, "uuid": "33544cdd-fbad-49c6-bb0c-b5de5f2e4e33", "value": "98304:aqks7SIdhJ5EjmFpHEhPAM7rc7R6MOgTfygxbXZSG9kyVwnEl:Ks7hW6FliZ07RHOYVNSXfk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689767159, "uuid": "8c663eed-6422-4d31-a2ac-21fa3ee28e65", "value": 4257809, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689767159, "uuid": "1a6587b9-a23f-46fb-90eb-d55742d0ba17", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689767159, "uuid": "0f43eb83-f7cb-422c-84f2-352706076ca1", "value": "c1395d15e10b5adc217126a6cd8cf7a57f778248.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fb3590e-2630-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689769835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689769835, "uuid": "e0e17d97-ffcf-4772-ac43-9f69ce7b957b", "comment": "Malware payload (RedLineStealer)", "value": "733d56ef4ac5dade9242b9ea76d224e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689769835, "uuid": "588d8492-d48b-4a3e-8c12-57e7f6aa98f4", "comment": "Malware payload (RedLineStealer)", "value": "66f2243ec87698177a19c068f8912517ff92fe0ac808b78d004ba326fd2e13cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689769835, "uuid": "473b95c6-a0b7-4bd8-9e0b-1a12de31a38c", "comment": "Malware payload (RedLineStealer)", "value": "f7903ba29c90accd9668fa5f398b0c3725fc3db6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689769835, "uuid": "907d0143-4878-404e-b7ed-eef7379d3ec1", "comment": "Malware payload (RedLineStealer)", "value": "d30716bdff1bdf394f7f4c70da2ec1a1c5441481d173347dd29bdb5b132ce4828105a746b9f305d82f4ba4d199a34ff2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689769835, "uuid": "2abb6ccd-a756-46d3-82f6-00fbcfa1e99e", "value": "T17C74F143AAE99173DCF12B705DF713D31A36BDA04DB982663642685E1CB36C4A83173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689769835, "uuid": "2eabbc86-ac57-4032-ba64-1fe4855651a1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689769835, "uuid": "c8f661b2-e20f-463a-807c-dcb468bb4422", "value": "6144:KJy+bnr+zp0yN90QEOllCFEvJd/ayMqRqmmyOft3uFBSCgIVOzVWi6y31pbUd1Tf:LMrjy900AybUmnKtUSCrUzAxy31pbi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689769835, "uuid": "6c2b2efe-0e07-4acb-aa3d-e78db58f4abb", "value": 367616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689769835, "uuid": "642e220d-54ba-424f-919b-e65783880376", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689769835, "uuid": "eaddc5ba-d5a7-427f-bd36-f8b0369ef0c5", "value": "66f2243ec87698177a19c068f8912517ff92fe0ac808b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "575da8a1-2659-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689787565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787565, "uuid": "d663e9c3-4564-48cc-a962-eda1f8d903ef", "comment": "Malware payload (RedLineStealer)", "value": "0c1b604be07688870ec06c103e1964af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787565, "uuid": "80de8b42-7a63-4c89-a0dc-b7c41bb5989c", "comment": "Malware payload (RedLineStealer)", "value": "6704de0ede035873f57ce22930f3d3b0e23ba418723be70870916c330d818c27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787565, "uuid": "83d08425-e2af-4aab-9867-f6e5ce9c1290", "comment": "Malware payload (RedLineStealer)", "value": "7efcfaab06b82f6c9cc11d02d626533b6c936e27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787565, "uuid": "08f5c773-a31a-4813-9790-39f8f28bdfbb", "comment": "Malware payload (RedLineStealer)", "value": "fb335aab45ce6f6172559ac0d67c53f68092d1c01ff5d46d6e9f68910253b685b742fbab1f95bd35b03eb743647bae88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787565, "uuid": "ee2730a0-66bb-4a49-a667-09e187f2a623", "value": "T12374E02236B1D033D06759310965CA927ABABC71AB7545C73B583A2E1EB03E00F75B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787565, "uuid": "689bc8cb-7e04-4255-8d54-bfe4853516e3", "value": "48a50e9b844c63f989e43958247dc403", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787565, "uuid": "e4a0fa1a-387e-40c7-b248-b31f249145f8", "value": "6144:zvlQKneRk8Z4jNU3bhB0uKJsx5kpOOyyG:mKnIfujNq9WDsfN5y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689787565, "uuid": "efeaa480-047c-4590-b64e-12db6e5d1426", "value": 353280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689787565, "uuid": "8076626b-b9ac-4ec8-989d-9a26c9292530", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787565, "uuid": "725b2a6b-ac7a-4f8d-9e8b-d465ff1c0230", "value": "0c1b604be07688870ec06c103e1964af.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b7bf01e-25fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1689747548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747548, "uuid": "b5de19bd-faea-4938-abb3-754aa2965ddd", "comment": "Malware payload (Formbook)", "value": "c5df113b70429793627aeefc4b593089", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747548, "uuid": "c39aee9a-7945-44ab-bb0a-4e25f546e80f", "comment": "Malware payload (Formbook)", "value": "67b07cfdc4ea5fcc63a80b9411e5cef72576ef6b398fd43cab2415dcbacd5ed1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747548, "uuid": "fdcca8c0-1522-42a4-ad47-9533c7601df9", "comment": "Malware payload (Formbook)", "value": "8b311ffb69bdc57ca8f100542b4404e990b443f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747548, "uuid": "470f55b3-3469-44fe-a513-42251b2ea989", "comment": "Malware payload (Formbook)", "value": "705a2c9a6c691d5ca733471586af97580f3f66b4b56952cc2b095865c365a783eb69d0fdf008d8f073500e9c7b778e80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747548, "uuid": "6aa054cc-4a84-4cc7-8163-f775254f4de4", "value": "T1DD44139436BDC467EB6703B02E7EA753DBD7E62500698A172300972D3D11242E66FFB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747548, "uuid": "ae91ca7c-6f0b-4bfe-97db-d1caceb58d52", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747548, "uuid": "f7b85e71-9ec5-4bbe-8779-547ae248f9a9", "value": "6144:/Ya6CMCFxkZIxHW5/HystvStt94sYlzaqM9xWDxQyIclpfQRvmz6T:/YkMCrkg25/ysSf94/M9x8KyIclpoRvH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689747548, "uuid": "a7f0fcaa-d04a-4b1e-8b9d-894089a86ecd", "value": 260414, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689747548, "uuid": "5a48b862-c6a6-48b1-9c24-c86c50fb8b8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747548, "uuid": "9717c80e-2072-4d82-babc-919bfe795dd1", "value": "PURCHASE ORDER 091020.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4949e82-25fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1689747751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747751, "uuid": "b2bc067c-e3de-4128-af39-29228dece1ed", "comment": "Malware payload (SnakeKeylogger)", "value": "d0fea0443b598ea2060e7ad1fb4c5b8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747751, "uuid": "ddb34977-141c-43e3-9995-5cf59e3db9e0", "comment": "Malware payload (SnakeKeylogger)", "value": "6894f623dddd03e3be59b6785c21962cf71686a215e2db68f83f621b01afa7ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747751, "uuid": "a9be12d6-4105-4bad-bfc8-9be2c82c1724", "comment": "Malware payload (SnakeKeylogger)", "value": "bed77ada64b77184047eff265b75bd71f8136f41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747751, "uuid": "26533752-5275-4748-b76c-741035d7758f", "comment": "Malware payload (SnakeKeylogger)", "value": "b7a4591692f1320fca6d18dce5910cef5d24511f5a6ec9361ecddedf5b4a789c39ebd680871c614983ab5ef2d347b4d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747751, "uuid": "dc6c8654-6a20-4bde-bb20-4b38a28184eb", "value": "T192F4A413B687CAA3F288173ED59B0C088761C98B722BD71B7ADE33A565433B6BC45507", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747751, "uuid": "4ed1c312-7d96-469a-b333-cdb1922e0e02", "value": "12288:SNnRIRp4ejE8krkBs5Omc1sth2pC+Fnsga0GcxgE/2:KYJkrkY41sthGGc1/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689747751, "uuid": "c4637655-dc8f-429b-bc97-95609c758b83", "value": 763392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689747751, "uuid": "9bd3d2d4-06e9-4c4c-a805-6098efa17a5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747751, "uuid": "973d15bc-3093-476b-bdbb-4be8115303b7", "value": "Kkoetzuo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e41016eb-2673-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1689798968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689798968, "uuid": "1b4c7601-e729-4ac3-a854-006498a12742", "comment": "Malware payload (njrat)", "value": "2f76e0186b247a653a7492cdb4e05eaa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689798968, "uuid": "78873989-3c2a-47e8-9b95-a10c664d51f9", "comment": "Malware payload (njrat)", "value": "68c1f74530323b80492c4e99b03178c592e748a1a2df18e75e458af270c59851", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689798968, "uuid": "371be127-4b40-4237-9502-1c6719258d22", "comment": "Malware payload (njrat)", "value": "ba9e39e4857041861a549d4f296138d090305792", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689798968, "uuid": "86c2ed6a-1bf1-4301-8877-b37477557c6c", "comment": "Malware payload (njrat)", "value": "fc7c21bec13e7e6d1eca07cfa815d4ab545152d7ae70af7305abbd7f4b1430746c4bed6b5759bcca029b23596e40829f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689798968, "uuid": "9904a298-a921-44a6-af1c-3fee4e4fcbad", "value": "T12644C4984E0A86B7ED2717B6D00B99711A88CE37C0D8FA51F7DB79B13235E1E426C1E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689798968, "uuid": "45f9e12b-fb3d-49a0-903b-a28f4488b54c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689798968, "uuid": "6b35f834-7f4b-45c1-a188-2838efd3fe3c", "value": "6144:vI5ZwpIkcE771AtV8s9gIAeofBqKNKKKKKKKKKKKKKKKKKuKKKKKeKKKKK4L:vIImkcQ6tV8wAeOQKNKKKKKKKKKKKKKi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689798968, "uuid": "d50c1534-4fd5-4df7-abbd-74d9f297f074", "value": 258075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689798968, "uuid": "864bac8e-48d5-4983-a540-3a7e746864c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689798968, "uuid": "8516d71f-086c-440a-8948-04a619968ce9", "value": "2f76e0186b247a653a7492cdb4e05eaa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da23342c-2615-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1689758579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689758579, "uuid": "a97a9947-4524-429f-a442-b5cb62e5db42", "comment": "Malware payload (Formbook)", "value": "c3c9d1fe5dd12a731e84fff133e8947a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689758579, "uuid": "db174335-4f68-40f8-bfbe-c13988e3a79d", "comment": "Malware payload (Formbook)", "value": "69062b4d020185ca57b01b3171d670445e91e3420c302e855419151439aaa099", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689758579, "uuid": "6e5b197b-23f9-4dad-aaa3-53547b09977e", "comment": "Malware payload (Formbook)", "value": "a12986f5c543d1837c9558bef94191663ed70956", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689758579, "uuid": "95b8eb2b-c554-44d0-8eb9-cf98416986a0", "comment": "Malware payload (Formbook)", "value": "175c81daab125ed216082f015e03bc19088791512534ea7dacab8e91f3ad27fe7d5d74de4daff522d7b19e3d012669a3", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689758579, "uuid": "51468437-d41c-4c56-8b91-1c3a0cd504bf", "value": "T148D423DA4D15C445D7BEBD286A76AF861F4F60BEC07BC3EA17A0C6D3E2489085760C4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689758579, "uuid": "34969c76-8b74-44f6-bcc4-96212285e236", "value": "12288:K1QENJvP/YnQLur627RrmTkBcfJKLMUMwO+0KscU695EO:KFYRRwQ/MU9OZ3e5EO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689758579, "uuid": "b9ff635c-ee55-41ff-867f-e8560ddbb16b", "value": 617781, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689758579, "uuid": "e7e4aaa3-0517-4cfd-87dd-bc49a167a4e1", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689758579, "uuid": "16b48871-e566-4da3-86a0-33f2a14d183a", "value": "Request for Quotation.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7ef8cca-2620-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689763219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689763219, "uuid": "005f595e-07b8-4341-9608-4f807622f020", "comment": "Malware payload (RedLineStealer)", "value": "fe58a84b8767249d2edea131a64e5e65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689763219, "uuid": "2bd5b4a9-81c5-4590-9e5b-b7e8db5d0814", "comment": "Malware payload (RedLineStealer)", "value": "69da17d58333a5244b9450b217fd81ed95df40450f37de33c514447b1723c888", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689763219, "uuid": "168136a0-9cb8-4386-a611-1c6bff8e1f4a", "comment": "Malware payload (RedLineStealer)", "value": "a3d984cb0bec53ed13e472f44b61c5a9a0d6f9e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689763219, "uuid": "553bcf6e-7834-44e5-8fb6-de6ccd90ed50", "comment": "Malware payload (RedLineStealer)", "value": "89bcf50df56138e796c7e163a7583cc3a013edc589cc6b00035b6419956b7997641f19fa3b802b23b5c8512986f41943", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689763219, "uuid": "d820f029-6745-432e-9059-4396d7fe95e9", "value": "T134840193FBE84522D9B52B3068F703D70A31BDF1DD38836B7785A84A0972295A13177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689763219, "uuid": "d2001625-dfd6-4aa1-9e9c-933935e01ad9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689763219, "uuid": "d8a84cc7-7823-4437-8ea2-ac9dc38b9e0d", "value": "6144:K7y+bnr+4p0yN90QET5+K79tWCfYRl31Dzj4zrHY3lj/ooTbEX5AVsbpZJNo:ZMrUy909Tr+hzj4zGl1opFJS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689763219, "uuid": "2ee1e50b-5e49-48d0-9599-dbaa4d6f52d0", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689763219, "uuid": "d522b79b-2c70-4957-8816-7ad843249155", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689763219, "uuid": "6eafc4f7-95c5-41cf-bd6c-6d18d2bf5a02", "value": "fe58a84b8767249d2edea131a64e5e65.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d066b9a3-25fd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1689748254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748254, "uuid": "26dff486-1904-44ad-9463-5ad9399e2c04", "comment": "Malware payload (Formbook)", "value": "48504c79581e8676162a135850196b9b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748254, "uuid": "7216a4e5-defb-44be-a0c1-f250a670eb95", "comment": "Malware payload (Formbook)", "value": "6a0e5686e8520c9c1e18923e464e92ebe6d32ee4219c9d1ae71215857f917b0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748254, "uuid": "c245822a-17c2-4161-a2a7-162edf2b5796", "comment": "Malware payload (Formbook)", "value": "ac6929facf7cb026b347e90fd050ec86f99b6a8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748254, "uuid": "44d01ebf-9056-43a5-a2ed-b22d6bc5b234", "comment": "Malware payload (Formbook)", "value": "fc9c74f6444b649bc702b37b0d7132c9c8ef4651b761a3eda46c9a53cd3191f6024184145276ea6552d2387ef3030843", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748254, "uuid": "4e82ff30-d3ff-41e3-9f95-9c26c5feb173", "value": "T13DE41240A7998A17D0BA03F85B30970053BC7F816527F9099FDBBDD9786BB404A62E37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748254, "uuid": "3100160a-c8d2-41a0-8203-ed7772aab6f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748254, "uuid": "270713b3-1656-47d0-9e9e-6cfa1007ac69", "value": "12288:HPYPfY7XzFl5AO3n5L8YUY3Hyr20IEEiOtk01J1khw9:HPYPgDzFl5AO3nBU1K0IwOtk0z1khq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689748254, "uuid": "9858d641-d2c4-476f-bcce-843056027c85", "value": 667648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689748254, "uuid": "17c52795-f167-49d6-9bbb-21cbe6c1ed63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748254, "uuid": "7f1d3611-04d5-4ce8-af35-2037fd073b08", "value": "SecuriteInfo.com.Win32.PWSX-gen.28393.10042", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51fe591a-2671-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689797864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689797864, "uuid": "50db7465-ed55-4a71-b65f-4db0e974bcef", "comment": "Malware payload (Mirai)", "value": "d7dcb0e0c12fb4960f2946c52797d224", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689797864, "uuid": "258c08ab-3a03-4e62-82a2-647f0e113326", "comment": "Malware payload (Mirai)", "value": "6b001145e0f2e644fb5ed60d22383c7a9417c814a141b8bdf039e1f27dca6019", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689797864, "uuid": "c36a2bf6-3d0e-4603-b2dd-bb9dfaddc0da", "comment": "Malware payload (Mirai)", "value": "99c4e6c91ecc2f3f6ab1163a5e02355ffa9794aa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689797864, "uuid": "a1d17ebc-d181-4209-89a0-2bf8001da95c", "comment": "Malware payload (Mirai)", "value": "7f18ccbf5430c8e5f058a32b577bd2e6ee39f8ec4738c628b05479040831dd30814997f9e59afb03db18acb5fc5a65b7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689797864, "uuid": "ec397023-8d1a-454b-9ebd-baf5f87bcd56", "value": "T14DC2E130419D5E52CA35CB35AB359984AF560BBCA3B320EBBE41A364E4C7453FB3205B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689797864, "uuid": "7245944b-7639-43cc-b5f6-5ab437ea4c6a", "value": "768:WRYtLOjiI0iTehHr6qiLGOXQJYu5RZZUs3UozGy:Wat9wALKGlYu5RZjzf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689797864, "uuid": "27aefad7-a790-4b89-bd8e-1779a857f3b5", "value": 26328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689797864, "uuid": "c89b67b7-d435-45c5-af23-9e3488b998c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689797864, "uuid": "d6ac887c-e7c0-432f-bc34-d9a87ae7267b", "value": "d7dcb0e0c12fb4960f2946c52797d224", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "971f21fb-2625-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1689765338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689765338, "uuid": "f2da0239-4172-4ba3-96b7-a66e8882135b", "comment": "Malware payload (GuLoader)", "value": "80bd4417b2e385920399426677b13fd2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689765338, "uuid": "b8659e8c-2c26-451f-9ba9-9d50ff207377", "comment": "Malware payload (GuLoader)", "value": "6b2700437e154ed0af5c5dc48ca93f6a878df3ba417143888019ec93ea501f39", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689765338, "uuid": "3346c750-763e-458e-9dbe-80c6fd3b0591", "comment": "Malware payload (GuLoader)", "value": "f05a177e40978c93d76afd9e668dfaea9dbe2e64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689765338, "uuid": "52ec4b56-911b-45da-9429-f706d9a30d6e", "comment": "Malware payload (GuLoader)", "value": "7452c6f2272cffb5f4d19d78b38e657880f57f1e4b6193c48d02365825593495d873ac6ecf4cef0fa5613f95ad8c2a34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689765338, "uuid": "057d7dda-6c3f-4b0a-ab65-30e5f6091eba", "value": "T172C412603B24D153C9615BB10EA3FAAE45F8CC097D35EE0FA31A785D2B343E25E1A356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689765338, "uuid": "9f1d2828-f66e-413c-9aa5-3686f2538d5f", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689765338, "uuid": "004d2a03-0304-4c1f-80cc-5de339d4cffe", "value": "12288:CQIh7MI/AGXJDPmn02d82Z5kYo9cp8x1n/J6O5ZttZU8gDKt:ehTc02dJZ5uZBJLtZU8P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689765338, "uuid": "95fbb8a3-c482-492f-a77a-b79aabb0ebd9", "value": 567530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689765338, "uuid": "03ffed8e-f061-4ef0-a84c-8a007faa7adf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689765338, "uuid": "8eef4b1f-ce78-4e56-b6cb-269655b39380", "value": "RQ21090048 - PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a37f4af-263f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689776349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689776349, "uuid": "308f7dde-c7c9-4b6f-9f86-a57596f628d5", "comment": "Malware payload (RedLineStealer)", "value": "24d6d039d21de25a3b921a7202b1909e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689776349, "uuid": "84573dd8-a683-4274-828f-f613fa269624", "comment": "Malware payload (RedLineStealer)", "value": "6b7ee0a57c1cfcfadfc414c782a371f8e3a29c75446a45c33b7a31e92e4ac802", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689776349, "uuid": "932c021e-0edb-400b-bc07-001d4fa38128", "comment": "Malware payload (RedLineStealer)", "value": "127b90ce2dfaa8ff71b3b30dfcf3f82153793ab6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689776349, "uuid": "0efb2291-b0d7-4e8a-8d82-74aba59865cf", "comment": "Malware payload (RedLineStealer)", "value": "1a3013daabeb5158da9f0a32705945da679f5771c42030655331fccb347c654957403ec06460c5afa086dc35fb916957", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689776349, "uuid": "a2aab860-abd4-493a-9722-ee039470470c", "value": "T19074F12132B1D076D1EB5A3159A186B02B3BFCA3877A51CB3799363E1E30AC01BB5757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689776349, "uuid": "3f7172be-c4ad-4d26-8325-4b25da1d2bbb", "value": "6d688d9cc0f6602b42d54dce0edb5c52", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689776349, "uuid": "e2704da1-b556-4049-8c2e-3aa68c7175ef", "value": "6144:qg7lXfn1iekLJyDZRbYmdZFx96C161+VGIZ0pEI9:FpXf14KLdZX96GLVdZ279", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689776349, "uuid": "8ef596a9-b9a2-45c8-89bc-29d01aeaeba5", "value": 346112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689776349, "uuid": "5700fab5-d799-4c7e-8ac7-ba58a473f9c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689776349, "uuid": "2bc5d6cc-3452-4ea3-99fe-649b864b1f91", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba9d1e57-260b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689754231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689754231, "uuid": "1ba57761-f7e4-419a-93b7-51b4e7305a2d", "comment": "Malware payload", "value": "64f9466d9195223950d7e68a84261d82", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "not fixed", "colour": "#7AAC96", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689754231, "uuid": "ba275c2b-c34e-43e3-9343-9046f718340f", "comment": "Malware payload", "value": "6b8e8711d792782d7d422d7023abd353ab21136fa8c8b97a237b52f7d489a072", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "not fixed", "colour": "#7AAC96", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689754231, "uuid": "ea6d8ebb-f045-4528-afb0-df1d314823bf", "comment": "Malware payload", "value": "1b9d6935421026676f2e39332894e61406768100", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "not fixed", "colour": "#7AAC96", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689754231, "uuid": "1437cc4f-d1a3-4087-a554-77f2bfe84263", "comment": "Malware payload", "value": "dc99798faf347b6afd9155744b0ac554ee2fe869f003a7a714fe85abf5f55ef8be3a8cfc4857e32f59cd583d998fba73", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "not fixed", "colour": "#7AAC96", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689754231, "uuid": "cf2bfa30-0726-49ba-97de-a657b5ff9f1b", "value": "T171C4233A4EB92B3A004DFB08B86D5DA7753497E5F42FA2E0C615FA087652EC4D3435E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689754231, "uuid": "7a30be04-ceef-454f-9b2c-a298a250a655", "value": "12288:L3cmEtMjzZCLemNZJZ8d+k6Dz6pLJ61ecC:bp0mzwLdZJy4vDGzsecC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689754231, "uuid": "76f56832-90e7-443f-aa3c-2afdd3519cd7", "value": 597226, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689754231, "uuid": "b5ef33f4-f0cf-456c-b7f1-e83380311778", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689754231, "uuid": "6ddc8013-aa90-406c-b27e-d81aa21a817f", "value": "Anexoinformaci_n Pagos pendientes REFINANCIAR O cancelar su deuda o pasara cobro juridico.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e877b9c-2671-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689797885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689797885, "uuid": "b4751e41-7c8c-4299-b701-e8f914361de0", "comment": "Malware payload (Mirai)", "value": "a4f9d404839f03b5fad50605980d0a3e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689797885, "uuid": "e03b7af4-8c85-412d-af06-0cf54d47db3c", "comment": "Malware payload (Mirai)", "value": "6c104312cde34253a2651406c9647879b07dfe64b4f4573a6ff859d9fcde7310", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689797885, "uuid": "ba10a2cb-8ce1-4c8b-87a9-7ce6066cfe9e", "comment": "Malware payload (Mirai)", "value": "4e86d7039b54c94c0542b54d1e5bc36ca83904ff", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689797885, "uuid": "1ae497db-963a-412b-9158-c3a07bbac670", "comment": "Malware payload (Mirai)", "value": "b44a4da2c90f6d7f7cdf54bb083994dc41469d65f19403e8c552954d71ce8deac68a1dd394b572931237639d0fdf882b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689797885, "uuid": "c407ecf6-bd99-4bf6-ae52-98189f2aca2f", "value": "T177F2E072F6626130F2D09974311E4F8536905CBC817FF811B0AA6A9DFDA2A52563EFC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689797885, "uuid": "7e3f1ccf-8681-41e0-b205-8fce5f33e4e0", "value": "768:nu9YDJSsqL8dTvlz+kZaJftXp/KJxrKu+lmLSZQaPm9q3UELCk:nu9CgsqL8dTlqk41tXp/K/5+sL+LL3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689797885, "uuid": "7f6245e4-2cfe-467e-81e1-a783d26e8644", "value": 34492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689797885, "uuid": "a31324c9-bdfb-48d8-8939-0889d5d30b92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689797885, "uuid": "033e95b4-d474-49d0-a028-c2ec0d20474a", "value": "a4f9d404839f03b5fad50605980d0a3e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3aa54a54-2633-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1689771196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771196, "uuid": "7c98d4bf-171e-4ff5-8f12-faa048f162c7", "comment": "Malware payload (Formbook)", "value": "14cadcc54906e374d407e8abfd758141", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771196, "uuid": "a0ef6162-6f36-4cac-88df-78a7095407ac", "comment": "Malware payload (Formbook)", "value": "6c1f6a504cb3e18cf89cfd2e9ef1b2c24f6b87e23ac66ab26d3786bb363e2e9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771196, "uuid": "efc94f53-3b61-488f-b22c-4bed47c65f04", "comment": "Malware payload (Formbook)", "value": "e48553919d40d953b7e4c98abce999bc8f2ced51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771196, "uuid": "37193f51-3fb1-4705-a219-217e406c706d", "comment": "Malware payload (Formbook)", "value": "5d4e49ff3ffe75d3b2a4d527a63f3037459494c9fd4661c608b88f85ca19c0ea06c609cde429b28837251a52e0f460ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771196, "uuid": "ba44e92a-b11b-4bc7-be08-2a63b58afb70", "value": "T153E4120029688723C7B4C7F95324A34463BA9F9D3552F12D9FEBECCA7266F052A50D1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771196, "uuid": "fba50835-6d03-49ec-9c7f-ed07605f2c77", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771196, "uuid": "02d02c08-cbf4-4ca5-977d-bc43a0c77e73", "value": "12288:UIPYPfY7zJmysSiCXGz4jiyQ6F6wYfePpy30qrAaL/DhdjnsHomv4XIIE:tPYPgJ3uv6FPYsqrAajfjnPmwXIZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689771196, "uuid": "3c3f8031-ebf0-4ce3-bdd0-7b0afc1693a3", "value": 669696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689771196, "uuid": "493e7691-3ef2-4068-9cfb-78d0759257cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771196, "uuid": "b60de42e-b54c-49f9-8620-ffe382d8acd4", "value": "PO780.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aa46035-2617-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689759197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689759197, "uuid": "f58b4dce-dd2c-42d7-bf4c-9ea30f627a3d", "comment": "Malware payload (AgentTesla)", "value": "5488601cee35afcd9bb0e6f6745d3787", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689759197, "uuid": "aacdea27-5839-4d30-8a24-fffd3e96ad64", "comment": "Malware payload (AgentTesla)", "value": "6caed3fe67e7752a452ba5b09bfd37255ad9c1f6f3a7a752958b78d3e26fdd27", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689759197, "uuid": "8b526f51-53e2-407f-9605-2ee36516b8b1", "comment": "Malware payload (AgentTesla)", "value": "287805031410b0f496b0639c4d82890302938edd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689759197, "uuid": "6815951a-f98c-4106-a151-1000d280f6e4", "comment": "Malware payload (AgentTesla)", "value": "ac90ea0f91be186058aa3777c14def7afd9a88d78bf4c22d50a9e97744d879b7286d3bf13841899ac6d9b01955544e2c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689759197, "uuid": "07210fb0-1782-4fdf-aceb-05e37808f3e4", "value": "T142D41254A7988A17C0FF13F82B309B2053BD6E8E6522EA4A4FD7BCD5742A7104661E73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689759197, "uuid": "52ab29d9-17e6-450e-8226-177329f9bba3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689759197, "uuid": "5cab2ae6-c4f0-47c4-a5ab-b11824248c32", "value": "12288:8IPYPfY7uvd+AlpRxdida/1zltUohw+0gCj7D86jAriU7K/ZiBE:8IPYPg6F9vAg1zltMhp//Ma", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689759197, "uuid": "6b26ee24-76c1-4cfc-9075-88063d00fe74", "value": 648192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689759197, "uuid": "8453d95f-45e7-4c80-a6fd-2a7d25ff6525", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689759197, "uuid": "5da85492-6e0d-4542-82cf-8788c2b469c6", "value": "CI, PL and COA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1bbe1c1-266f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689797246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689797246, "uuid": "d0b0a7e7-2a45-4ccb-bf26-a07240bbe11b", "comment": "Malware payload", "value": "7e558920c8567f9fce24004d13de33ae", "object_relation": "md5", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689797246, "uuid": "873160cd-41c4-43fe-9557-06ab9885377f", "comment": "Malware payload", "value": "6cf76898fb3ff5726449f6a47748e2cb4559cae3d7e34a0d6d5d169ffdab483a", "object_relation": "sha256", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689797246, "uuid": "543b40c4-109f-405a-9779-c2bddeca68e3", "comment": "Malware payload", "value": "3e5720e4804d6c88b618692027aed9fd585f1b55", "object_relation": "sha1", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689797246, "uuid": "ce7c45ce-b226-448e-b58a-30927320ddd4", "comment": "Malware payload", "value": "faf5b9dd42719bd853e34c7e1a2b1f9c9f8469cfeb0106d1762830df38974d1c30d39eaaa636cd3a58befea9be3f1b59", "object_relation": "sha3-384", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689797246, "uuid": "21886820-b5cf-4cd8-929f-b04f88562938", "value": "T1EDC49E1176C6CA37C57A06B0362E979B5628BE6447F2C0EB23CC6D1E1D739C05276EE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689797246, "uuid": "d372dee1-f9cf-43ad-ad5a-42582961c324", "value": "6144:pvKdXY5AUC8rDow+ZsrLg3bmfKlGzIqSqYf+SAOfVKE/M5TiyX1pjhZW:pvKlY5AIowv43bqKlRHJVa9iyX1pjh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689797246, "uuid": "0c803dbd-c2c8-43df-8206-a94f783be3c8", "value": 583680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689797246, "uuid": "a2679668-cc58-4084-9af5-9bbb8ed01381", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689797246, "uuid": "0798f202-88a5-410b-8dca-69cc0192d199", "value": "F\u00b498074756.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c9ae1d6-2633-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Vjw0rm)", "timestamp": 1689771172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771172, "uuid": "e399de84-316b-483b-a2b5-ef407959d48d", "comment": "Malware payload (Vjw0rm)", "value": "7253f19b242503fad9a8b4e106d27318", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771172, "uuid": "145f69fc-851c-43c6-a8ca-f17a64e4c959", "comment": "Malware payload (Vjw0rm)", "value": "6ec3e682fbbd0c23fb4e3a2c2b28f03431b90a88651d227ae3f33b6fadf507cf", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771172, "uuid": "7645d425-3741-4e9f-84e9-d257dbecb0d9", "comment": "Malware payload (Vjw0rm)", "value": "58accce68dfd8de6e378956387dfbceb8f964287", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771172, "uuid": "8124407a-3afa-483a-8ff3-27c539f5330b", "comment": "Malware payload (Vjw0rm)", "value": "aff0cb915e96d1badb28ec299dcaf977a96df3b318bd74182b2ee7ce15071bb138d9744e8367fc51ac30408d6424daa9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771172, "uuid": "5d203f0c-7cf5-4346-9183-a43b8b3e0720", "value": "T12D15DBC625B93A1697A3FA24C311D522AC34EC232DD711D2BDC47E4ABD76C445EBEA30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771172, "uuid": "4eacd8fc-8679-47aa-be18-d17c4bf54f76", "value": "6144:QQLz4cW/pKERl7E9USsfl07aGvbEVyzNeez2V6M5uk5jrtnQ1RGlM9VIfSRIwIcw:T7X4oRVW+L40gqNbEMlp4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689771172, "uuid": "564d0e82-8495-4bfa-89d4-63dd9f599df5", "value": 917836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689771172, "uuid": "2207af5a-ff0d-4688-a55d-947162683ef1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771172, "uuid": "95fd9ca1-3fee-4201-b415-e6284bc4d8c7", "value": "Request For Quotation.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55bbbf3e-2659-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689787562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787562, "uuid": "106196be-080c-4f30-82fd-8fe31a17e6e3", "comment": "Malware payload (RedLineStealer)", "value": "cc8e065450bbdda4c16feecb24076e2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787562, "uuid": "dd8f304b-46c9-4292-868b-ba4038d5ea4f", "comment": "Malware payload (RedLineStealer)", "value": "6f3a05d37efcc981af4efe2ec06d9269658c6f34e0fc0c678f1b58296c2dddd9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787562, "uuid": "a68f1c8b-f040-4402-9ee5-be0215c7e1a9", "comment": "Malware payload (RedLineStealer)", "value": "d0d2f8a71d357dc0dce609199f2c7e6ccdc1fbc7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787562, "uuid": "7b2f9fc9-a481-45ec-b46e-2f288e813339", "comment": "Malware payload (RedLineStealer)", "value": "fd3dca9929da87aed5f5899dd39a76c90e1b18bcb7eb412dac943629aeb24bb0e782003f136a3059feaaac28ac3beaaa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787562, "uuid": "34b3caa6-5c3b-4d4e-a6a8-ac27f1fce208", "value": "T1F6840113E7EC9033D8B107706DFB13830A3A7DA168B4836A2785985D0873A99F57677B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787562, "uuid": "023bd015-b115-44a4-993d-551c42826a06", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787562, "uuid": "51476122-080b-4b56-b001-00bf56310024", "value": "12288:CMr6y90+ryasHBdOEjIIOOhHFcHnl9kmbp:cyxJEjIIXpSHombp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689787562, "uuid": "60baf96e-13e5-477c-aae8-05bd7143327a", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689787562, "uuid": "4b4f7143-f35d-4c30-bbbd-03fd34ac9df7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787562, "uuid": "ef8f5768-657d-48b4-9236-c1ac6987068c", "value": "cc8e065450bbdda4c16feecb24076e2d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3de5b30f-2671-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689797830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689797830, "uuid": "5f3952d2-2059-4053-9a87-85980f04e676", "comment": "Malware payload (Mirai)", "value": "3312f7b353d9078626fce5e8bd736f5c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689797830, "uuid": "d0607cb8-2268-405b-8ab3-36d4b41945cb", "comment": "Malware payload (Mirai)", "value": "6f7f26bdeecaf591ca157de6acc838d62dc5a1177bef1a9636e5fcdc03b059f9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689797830, "uuid": "ff8041b0-2e37-42c3-84e4-1f80e3a85dc4", "comment": "Malware payload (Mirai)", "value": "ea858d5d6cd7a9fd1ee64caafe89f69cf6bc1868", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689797830, "uuid": "852596d5-92de-4a5f-b0e6-d738cbb9188e", "comment": "Malware payload (Mirai)", "value": "5562fb304c3ddccad63145e263cb3dccfcee3934ec53effd49e057edcdfafa79ea0c166991feda14886af6a0330da702", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689797830, "uuid": "0541031b-86d6-4a63-b275-f8a0940ad41f", "value": "T1F4D2F1791B44C871DB50863AACBC434573475AB1E2FE33625F500A29A2C31C9DDBFE6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689797830, "uuid": "becce4ea-ad58-4ff5-9c02-9f5dd0884b17", "value": "768:atFPMu43+Knj412MjX2YNoTdv0Wt4B1lkrmRs3UozS:aD0uwqxkTN0l+rXzS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689797830, "uuid": "f16b229c-ce04-4e25-a23d-30bc009eb412", "value": 29968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689797830, "uuid": "cd7c9fd5-6347-40ea-b59d-3bb65bd52e5b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689797830, "uuid": "18274e92-a141-4fea-b1df-de6622f02b18", "value": "3312f7b353d9078626fce5e8bd736f5c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40a0c5f7-25e5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689737705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689737705, "uuid": "1d6a4c5f-4d90-4715-83a4-79fe338b1c2b", "comment": "Malware payload", "value": "b15a0e59e709856f57c011a4110fae6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689737705, "uuid": "598e784e-1edc-43a2-9887-80ee564e8d64", "comment": "Malware payload", "value": "6fa95e4e25eb2cf60595af08ca20573f260e87b40a8202bbcfeb439634f0aeb6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689737705, "uuid": "786c216b-046e-437d-8b82-29a5907e5d99", "comment": "Malware payload", "value": "53b9ba00065d07992fab361316441de49eda1626", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689737705, "uuid": "da78a40a-6fb5-44f8-921e-d815e385b10c", "comment": "Malware payload", "value": "ef71053d60ce8dea387b4ebc33be6b71544974c1ee08b3542b641624f242f9267e8d7864d1fa9e42f1d886fc509b7e05", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689737705, "uuid": "e08f87df-51c7-4d11-bdbc-1a7b00512cd8", "value": "T1C6952302BBC156F2E07638374E758720A57DBC200F16CAEBA3C8595E9E105D19F36BA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689737705, "uuid": "cf14b49f-69c8-4e06-aa89-2f8d0f11ec61", "value": "aac51396886833dc961fcd7aab7711e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689737705, "uuid": "7f97d7b4-50d4-4d7f-afc6-5dca34f6bfaf", "value": "49152:zereFL30O/xFBOFFW34tx9sZ7/3UY0nb5D:zueFF/xrMO4P9s10t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689737705, "uuid": "c438c211-4aec-4571-beda-bd63e5eaf9cd", "value": 1902727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689737705, "uuid": "fd8f98f4-4286-405b-9d69-8f73b15ca8ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689737705, "uuid": "a9c35c6f-11c3-47f6-90db-d1f3bd367b89", "value": "BC32.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c10c33cc-2629-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689767126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689767126, "uuid": "e7179982-072d-4c05-8ba3-7cecefd74d3a", "comment": "Malware payload (Amadey)", "value": "e0f40936ea504166e3ca357fdcc3d5ad", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689767126, "uuid": "ac33e7c3-1da2-4826-9f94-3daa2ffd530e", "comment": "Malware payload (Amadey)", "value": "70d208d1a80d684b03034533a07b503b7c16642a604e01b3abf06c5181cb92d1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689767126, "uuid": "341aceb1-f977-44ed-a3a8-24bb51d94c9d", "comment": "Malware payload (Amadey)", "value": "7cf55960e0460817dd5681252024c24c46ac9f8b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689767126, "uuid": "2d90f546-9e29-4f9e-ba35-d3485b5e143a", "comment": "Malware payload (Amadey)", "value": "3db2c36088deee72fdb106fbf742892dbd36e0d28ed6f4e5aa92bc6139b5f4e4438089f29400f24b55c225d81ed061c9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689767126, "uuid": "4cccdf62-33c1-4236-977b-e402f207cea0", "value": "T177B41203EBE89433DDB42B7048FB03D30A35BDA18D70935727456A4A1DB2AA5B5707BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689767126, "uuid": "42aff833-2022-4146-808b-3730338e1a1b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689767126, "uuid": "ae2081d6-8317-486a-a144-df491a2c042d", "value": "12288:NMrXy90WOd1JgZsPhYIdsvkaPP7PZUdD53IHYTV4918Lc5v:2y1Od125tvka3TCBeCOaLc5v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689767126, "uuid": "5bcb25c6-ec14-4829-82c7-12dfe13b9591", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689767126, "uuid": "c18f33ef-e172-405f-9d01-ae1e09ce9beb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689767126, "uuid": "631e5910-af57-4449-9247-3f31b10f9578", "value": "e0f40936ea504166e3ca357fdcc3d5ad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58d72789-267e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689803459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689803459, "uuid": "32b68b97-e7e6-4015-806d-8cea565fcd30", "comment": "Malware payload", "value": "54cbe835ac726ec258b58566cab62aaa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689803459, "uuid": "0de12d9a-6d76-4a3c-bbc3-8fb49223aefd", "comment": "Malware payload", "value": "73a8b0306a237247a9ae4187e6d3df691bfb5069a2cf3755597c48631a3f913d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689803459, "uuid": "abb2c986-7aee-4509-91a1-7daf83ea8e92", "comment": "Malware payload", "value": "4b8ab17710fe380fdd565b21673a645d8b2085af", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689803459, "uuid": "270d9b75-a6c0-458e-baa0-8efb26869cff", "comment": "Malware payload", "value": "4aa493aa7bba65392664307e5c9c8c7b740d93640fb573b3fbde08eaae550940fb1bf593d699e9215cc0d89e2d81fa1c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689803459, "uuid": "4222b874-2731-4f63-b1a3-31701998db8a", "value": "T18E063326BE62D1D3C3190235C0BFCAB964613F5128615A436AF17EDBFD717432E4EAA0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689803459, "uuid": "d4bab2e7-2d82-476e-9fec-9944f961f25e", "value": "36931dcefeb26f32aa1f4ff6c891684d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689803459, "uuid": "840e104a-8037-4ff0-b848-031858309a1b", "value": "98304:EXY8W8Wdatv7vsldD2ljL0Du5Gi20MwOmawp:2Y8Wkd7+DULUuYismz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689803459, "uuid": "1e7dd19b-dbab-4881-bef9-dbe40dcded23", "value": 3718816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689803459, "uuid": "a6f60db4-e570-4e19-805c-c261206f2596", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689803459, "uuid": "0c83c6f9-ffdc-4c36-be8e-1edfd3fd8b4f", "value": "54cbe835ac726ec258b58566cab62aaa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2465dbeb-2639-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689773736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689773736, "uuid": "770a4698-c174-40c8-b618-964c7eacccff", "comment": "Malware payload (Amadey)", "value": "932d72dbb9e47863813fde96f1b80bcc", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689773736, "uuid": "6f6837fa-e460-4622-af6a-871120cf503d", "comment": "Malware payload (Amadey)", "value": "73b174c6316230888f3cef2a93ac3f4ba3d35897fa82181cd83beceda6fa7606", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689773736, "uuid": "2f665a21-0b10-41ba-b14f-e0cb9a18d3c1", "comment": "Malware payload (Amadey)", "value": "f945ba7966a0fa0f006850b76252c8bc8e13d83e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689773736, "uuid": "6fe0065e-6154-4335-b777-ecb1fb60bc85", "comment": "Malware payload (Amadey)", "value": "27bc94e0b9645bf3c25d87a3d4cd6b80344dac370c5a83e9c21a97d0be6067282612a0ba293c1d6f8a57cb146159aa21", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689773736, "uuid": "5f120901-65eb-4102-9251-e040826c8234", "value": "T12F44CF2136E0C0B2E4675A301970D7A22A7BBCA29B7181CB33543B2F6E713E15BB5757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689773736, "uuid": "951f53b5-e780-4474-b5f5-ff524812788a", "value": "6d688d9cc0f6602b42d54dce0edb5c52", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689773736, "uuid": "8f759b8a-2ff3-4d75-9ac1-f47bd88493aa", "value": "3072:t6dPRwnF4nmpagIKt+H11uEld44gNW6o25q0vMQU5:tI5wnF4nmpeKt8uqvgNW6oQq0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689773736, "uuid": "f6cf57cb-97ac-4419-a561-5bda512580d7", "value": 254464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689773736, "uuid": "70b9df09-6ee3-4ee2-97d9-371f495826fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689773736, "uuid": "33cbbf66-ab6b-459e-8c58-9d74a3b80a19", "value": "73b174c6316230888f3cef2a93ac3f4ba3d35897fa821.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a21a1c2-267a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689801636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689801636, "uuid": "0a583e0a-cb6c-4a48-9a82-3ef9229c16b6", "comment": "Malware payload", "value": "75cf881a35b27fa6389f21db70581604", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689801636, "uuid": "9de6d73e-73b4-4f11-9561-a0b895294dae", "comment": "Malware payload", "value": "74f7e2150867e4e9953d8471bdc58cc379efcb19914ef997d239a0d8b2a1d7cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689801636, "uuid": "3e6a7e9b-c0e1-4ff8-bfab-e7b0baae06bf", "comment": "Malware payload", "value": "106f724fdf382a3cfe311b06de92b194c06428e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689801636, "uuid": "f2830414-b807-4133-8754-d3cd0255258a", "comment": "Malware payload", "value": "3e8ad3edd52dce9d19999b32f93fdf627ee35f4a27120703632e8af6edb9677759e012c986ee6fe093a1cdcc8b2a961d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689801636, "uuid": "10149916-7558-48c3-bf8f-345b12e3f462", "value": "T1C6840102E6DD8073E9B51BB058FB02871F36BCA15D74836F2785A99F1873680A53637B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689801636, "uuid": "8883141f-3805-44fd-9732-903e94c0388c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689801636, "uuid": "eb717ddf-413a-4cfa-abae-96dbeffcaae2", "value": "6144:KMy+bnr+Sp0yN90QEAI+mdlWXUkWcnZNbNYWNIcveriFIaBxxpCWPt7oyn4:4MrSy90b1KQWNNveriFIGPyj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689801636, "uuid": "aa2cb800-e632-462e-b3a1-a362bb72865f", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689801636, "uuid": "83fef0e0-a5ea-4e4e-837a-080025e9273d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689801636, "uuid": "b4c6c89c-55eb-41a5-8cb7-aec150b78c21", "value": "74f7e2150867e4e9953d8471bdc58cc379efcb19914ef997d239a0d8b2a1d7cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6a97eba-25df-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Fabookie)", "timestamp": 1689735299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689735299, "uuid": "8ebd3686-cc5f-44c9-889c-33d6bc986f6c", "comment": "Malware payload (Fabookie)", "value": "84bbbaa2822163e59538a6ba2f108ee3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689735299, "uuid": "8de40f2d-dcee-46ab-bea8-483f0602e246", "comment": "Malware payload (Fabookie)", "value": "75199959eef6bca77f13f285685b05faed159bca05442d8e9f93aa39e45c7cb4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689735299, "uuid": "7d75f2b7-51bc-4b43-a903-97a151204c64", "comment": "Malware payload (Fabookie)", "value": "a02f1c16c8719c34303c3426e35ebe9d8dc19214", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689735299, "uuid": "48b7eafe-b04e-4d77-a312-21ca170ce6f2", "comment": "Malware payload (Fabookie)", "value": "857f410fde504c90d33be97e26f63ddaf562a3ff853036f597ace64468acb48809cf564eb18d23ab1676d8930bcbb70d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689735299, "uuid": "6fd52b63-c2f8-45f9-9abc-b3e85c9b2407", "value": "T1E326AB927340CABBB2F7CC62C7537DD3D25EAF2B21BF2DF5C425279626222211183965", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689735299, "uuid": "262964f0-704f-4c6b-81a8-5b2c513b0ecb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689735299, "uuid": "f795d06f-fdf5-4888-b747-f38183b50d4a", "value": "98304:HNVGiFqFCMAAl1OxLsfgoTyYYtIYmHXiRNcYLeW5k8AawsKn:H7zFDFLr15Rdbina", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689735299, "uuid": "8fa33fa1-3144-460e-9aaa-2976c8283aa4", "value": 4709888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689735299, "uuid": "d1ca7486-b5d6-4531-912c-10bd6e327273", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689735299, "uuid": "e1cd5c3b-8500-40d5-9c51-7baf987bb31f", "value": "35BD.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9fbd360-25de-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GCleaner)", "timestamp": 1689734956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689734956, "uuid": "4e459484-4b86-4292-b0e1-e4a61fa9f2bc", "comment": "Malware payload (GCleaner)", "value": "9378aae1313040834020ca40976e4b1a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689734956, "uuid": "43d45d67-c89d-4287-930e-f086a719f740", "comment": "Malware payload (GCleaner)", "value": "753c162a84c55747102968d172e78b220903703c216010462a006d5779b9bfec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689734956, "uuid": "b008a08e-4ede-4c90-bc42-cededf1c0612", "comment": "Malware payload (GCleaner)", "value": "05d8fbf947dd56eebe79bfc5d48b5ce13237a551", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689734956, "uuid": "f5dfd1b1-9881-4d2b-86d7-574f0bc3bb85", "comment": "Malware payload (GCleaner)", "value": "3bb2b7297a3e7ed9e795819bbb2a4c1bc7918b114e721f43cf5e251935df1877a42d3b81def72b8b4e5720c19e35c64e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689734956, "uuid": "cb2689df-8858-4b3d-affe-a5a1dcec5371", "value": "T1CD84084392A13D54E9258B729F1FC7EC730EF2508E8E7B696129AA1F04B11F2E1B3715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689734956, "uuid": "3c4e5efa-ab58-4a12-894a-c3908d0d297f", "value": "41b4eb7c12331a5ff00a984ecb434d03", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689734956, "uuid": "33a26f37-35b6-4e70-afdc-94313a27c87f", "value": "6144:wjLLmsM5tXl0gl+qbYuIlXDSxo0wJ098wzDYgdLiwnIO:w3Cs8XyE+qbYuIlX5PJsfYgN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689734956, "uuid": "64e93d07-09a5-4f9d-915a-493cac9bceca", "value": 377856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689734956, "uuid": "0c14d4de-e81a-4332-8349-8b9a21799c15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689734956, "uuid": "91e447b0-f095-4877-a2cc-5ef7e6a5f7d5", "value": "9378aae1313040834020ca40976e4b1a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "514243e5-2659-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689787555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787555, "uuid": "07d01f73-ca36-4b9d-981a-1f046ef4da50", "comment": "Malware payload (Amadey)", "value": "58d3d7b38cdf565f40600c4f84de48d7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787555, "uuid": "e9356849-1c03-461c-9580-100901bca23b", "comment": "Malware payload (Amadey)", "value": "76ce55b4d5a119f06c367a346ae1862c303beb76b2c774f07526af067c28579e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787555, "uuid": "dbfab411-df8c-4a80-a0d5-11949891b6fd", "comment": "Malware payload (Amadey)", "value": "bfaf48e19cdc476f76cba56d8c3e656eece773cd", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787555, "uuid": "d51f61a2-bebd-4f28-8e08-49302b970315", "comment": "Malware payload (Amadey)", "value": "1030a96de602e9ebff7780262f4c616ed36ea11fe8cfddafedc0be78e7b3bb83bcc0c3512ef30e8e1921fb3ac6e796e1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787555, "uuid": "663cf0e0-813f-437e-946c-0383b4695ecd", "value": "T104840112E3E99033D8F52B7098F606D30B36BCA19D74832B2785688D1CB36D5A57277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787555, "uuid": "50539fa9-8ae3-4038-a200-7a4d56086c2c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787555, "uuid": "00884ccf-d428-4284-998c-29ca681a136e", "value": "6144:KLy+bnr+Wp0yN90QEX8JiDsTwevTqZSJ4cfq4++uf8KnnRUIBr:BMrKy90F4iDuTq0J4c4r8KZr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689787555, "uuid": "c299139a-2996-4300-985b-982ba8061d72", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689787555, "uuid": "adeab3f3-5898-4b27-b89f-abc1eab15d17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787555, "uuid": "d8d47b56-44a3-4d2e-88b8-fe6db214c44c", "value": "58d3d7b38cdf565f40600c4f84de48d7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fbe0cce-263c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689775177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689775177, "uuid": "2dd9fcb8-0b78-4845-a3ce-4e0679936b6e", "comment": "Malware payload (AgentTesla)", "value": "f7e5ada87ae452de950a7a571da9ce0f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689775177, "uuid": "bb0250e9-30b4-4e88-a151-bcf6b586c3bc", "comment": "Malware payload (AgentTesla)", "value": "7707593256e531aa9f07332f63d34a74487d0e9abdeabef133ae8021a1090f25", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689775177, "uuid": "d4b2635d-aaff-4334-8631-b96245942cb3", "comment": "Malware payload (AgentTesla)", "value": "9a314851e06b96fa33b53eb9e76fae5bad7a38df", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689775177, "uuid": "647eb861-e69e-4e24-8898-7f87489232c2", "comment": "Malware payload (AgentTesla)", "value": "1d65e8cac48d06b57317e4d1d322d3c732cc58212df9ea2f81322bd3d254e67a2b507504f5af3785da64136426595b85", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689775177, "uuid": "7394723b-6b72-48b5-b6c6-4b891d6aa517", "value": "T107D4121136A84B13C2B4CBF91364970453FA9FD928B1F46D8ED7ECCA71A6F105A90E17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689775177, "uuid": "f613d975-078d-49e3-b822-5696c1628da2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689775177, "uuid": "1e188991-c45b-4c55-b118-f289fdf3d6b7", "value": "12288:fJPYPfY7ksNJ0gW7SqCZO5JtHeZnKZ6aVcPm+SbEA:hPYPgRW/CDKR8SbE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689775177, "uuid": "67075f67-0a34-4918-b164-968a2f5ff84f", "value": 647680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689775177, "uuid": "be7acd13-a36d-4af4-8dc6-c97ef73d350b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689775177, "uuid": "410ba565-c255-4366-8781-ba6613410c1c", "value": "f7e5ada87ae452de950a7a571da9ce0f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dec0e425-2673-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689798959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689798959, "uuid": "bbdd1739-9952-4a55-b5db-21bc65fc8907", "comment": "Malware payload (Amadey)", "value": "d6a159bae10a18e2009766784b7a5d78", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689798959, "uuid": "3708d0a5-7a49-4a6c-bc47-83919527c165", "comment": "Malware payload (Amadey)", "value": "775729007e25368ce6673e5918c04104e11071694fde89d7e731eaa496f3cca4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689798959, "uuid": "1608cd57-15c7-4b6c-9afa-6ecea1c290cb", "comment": "Malware payload (Amadey)", "value": "c8f31aeb50e9753ea54179c917f9ee79f85e4fdd", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689798959, "uuid": "23d65387-6122-4346-884a-4485e8fe7198", "comment": "Malware payload (Amadey)", "value": "e61b07f2f6493cb4d6013fbbcdfdb72335c2d9e5ba3499e0d16581c56fca1bc9daeaa4008be2ab1ae153d1039e5a6285", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689798959, "uuid": "f0d67d1e-8f7f-4caf-b724-abef1280d36e", "value": "T166840143BBE88023E9B9173019F207C307367DE15EB4436B2786999E0DB3685957277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689798959, "uuid": "2b3571e7-6951-46d0-bc27-bf9af1ace3bb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689798959, "uuid": "bb8613b8-2008-4210-ac14-d11d255fd056", "value": "12288:CMr9y903+ZEMLicrsgbPloqMcHnl9ZlrQabwG+wh:TyJZEMul6/THLcZ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689798959, "uuid": "4d21202e-f855-4019-be4f-f6f128ae497b", "value": 399872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689798959, "uuid": "a2202fd5-d50c-40a1-b600-715c2616b9c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689798959, "uuid": "ec0430d4-4733-4cbf-8092-d2f34896ee93", "value": "775729007e25368ce6673e5918c04104e11071694fde8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73e3a881-25e5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689737791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689737791, "uuid": "32d73845-370a-46d9-876e-aa01167cda27", "comment": "Malware payload", "value": "c1de7d8f17e7b08b0a0a69d63ea4c0c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "TrojanDownloader", "colour": "#504DEF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689737791, "uuid": "352121e6-29c0-44a1-807f-1ecf435ac27a", "comment": "Malware payload", "value": "78814ac115992f6ae9da08c10991fcc5a824c43caf7a75881427feac3bb4cd62", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "TrojanDownloader", "colour": "#504DEF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689737791, "uuid": "a471f58f-4f14-4514-b842-979905bb414b", "comment": "Malware payload", "value": "29c9a03fba3a139551455dc28a80c2d1aaf69f6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "TrojanDownloader", "colour": "#504DEF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689737791, "uuid": "fb9af279-2bbc-4df5-a659-8ef138e638ba", "comment": "Malware payload", "value": "a95af628299ebfd8e44cb637e478f2f68e12ad132a891a46ae4f55a7e1afdeec959f48c5b12c985158373b474c63854b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "TrojanDownloader", "colour": "#504DEF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689737791, "uuid": "f1402c9d-8209-4529-af2a-eca65514aa97", "value": "T18EF4B403BA9F86A2E2895732D5A7CC8CC361ED83F33BD71B754E235A54433AA9D41607", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689737791, "uuid": "fb53bf63-704a-4a6c-8264-06aafe9cc24e", "value": "12288:cZy7q1qh28Z43wy27LEbPeJQPsnN5JtQ:cZoVMoaU7LEbbsnN5JtQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689737791, "uuid": "504bf97b-61c2-4f25-bd1e-517a5a617036", "value": 724480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689737791, "uuid": "8dfd81f5-0046-4f7a-add6-000955bd0cc2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689737791, "uuid": "764870ca-2608-4207-8fb1-3a38a63bda36", "value": "discussiiontelecommunications.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03af6db7-266b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689795156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689795156, "uuid": "15071bb9-b39d-46c6-a574-68f97a6e8b85", "comment": "Malware payload", "value": "b1ebd98509cc584fcf8503982af45bdf", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689795156, "uuid": "a2865a98-3a2f-45f7-b5f2-2815b1352344", "comment": "Malware payload", "value": "78f95207d3f4243220077b94837952c1863a5ed08e370abaaeecdb8ca58e8d6a", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689795156, "uuid": "7cb42607-4468-4aee-80ad-a2636948409a", "comment": "Malware payload", "value": "4c436805080aa48d21956ca007abb99ed4079b6a", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689795156, "uuid": "a58b3b3e-85ad-4bb7-9004-44f37d04b5e6", "comment": "Malware payload", "value": "e6879583627e1e334d642c7a36cc38bc11d87284d7d65911dac0a25ce25074386471abf4e247fdb0aa2acabbe6ccb205", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689795156, "uuid": "d57e3fde-ee86-4658-8dde-1a00c1950651", "value": "T10203B15AE78F02A58F520273271B0E89A6BDB63EB3505571385C933433EDC7D42A66BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689795156, "uuid": "3ff96c59-0fb4-46bf-9083-6920ff298b45", "value": "768:xFx0XaIsnPRIa4fwJM5Lu0PpLQ8xEF1NIGRujCVBCV:xf0Xvx3EM5CTF1vVB2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689795156, "uuid": "61961d25-4ca0-4cb6-9a23-a57fa0466f5f", "value": 39921, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689795156, "uuid": "fd01bbc4-02cc-4261-836e-e55bdf84ad5d", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689795156, "uuid": "48ab1962-8aea-47f5-9edc-aa129dd6dbf7", "value": "SecuriteInfo.com.Exploit.RTF-ObfsObjDat.Gen.20941.28544", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ee894ee-2627-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Hydra)", "timestamp": 1689766130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689766130, "uuid": "e7de6006-5546-43af-8916-d33aac7393cf", "comment": "Malware payload (Hydra)", "value": "4252f2a68abdc351ad2de4f9bf92ae41", "object_relation": "md5", "Tag": [ { "name": "android_hydra", "colour": "#626579", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689766130, "uuid": "1db0d2b3-a1c0-4424-a86e-5fb9c8147b04", "comment": "Malware payload (Hydra)", "value": "7992e77076df57c535e7d155583f2b5ee754270cd40dd28c2b908dc2c17a3762", "object_relation": "sha256", "Tag": [ { "name": "android_hydra", "colour": "#626579", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689766130, "uuid": "83c6bcb9-b2d8-4a0f-827f-14b5d07166b9", "comment": "Malware payload (Hydra)", "value": "cef1a4c34d1f8149fb34e4b02444d0c4c18d74c8", "object_relation": "sha1", "Tag": [ { "name": "android_hydra", "colour": "#626579", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689766130, "uuid": "ca76070d-e7da-466b-9463-322842b7cb55", "comment": "Malware payload (Hydra)", "value": "241016e074f8bb396028a99f5ff7d6a695fb8db81cba9308706fc0fa6466fb322322d0a785a024ba5c1a12f950f1f854", "object_relation": "sha3-384", "Tag": [ { "name": "android_hydra", "colour": "#626579", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689766130, "uuid": "292d47ad-acb9-4b67-8995-9f85b4b4bf78", "value": "T1AC163345B3A45646E0F71A348E276282913F3CA0DBABC15F3836735EA0739C513D69BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689766130, "uuid": "0c9d876c-9bfb-4003-9ddd-cfbfc6b4dd4c", "value": "98304:yB0sq65FXldRU10lDEjU1raeAXTUT8zuGIOuyMYsETrWwEO6P10Ak8Y3VL:S0WJdRS41L6U4zXI19Yso5ExWAk84L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689766130, "uuid": "25f131cd-fd13-418d-9ea0-071c3e73cab4", "value": 4044464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689766130, "uuid": "a457ba41-3bc3-405e-9361-0660277d48f2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689766130, "uuid": "f69b9f1d-5af4-481a-bdc6-a72c0df1c5a0", "value": "9-aligned-signed_en.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d77bbf2-2630-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689769832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689769832, "uuid": "f43322b7-94f0-41ae-ba0e-efb3b608bb96", "comment": "Malware payload (RedLineStealer)", "value": "0fa62ebed394e0d1ca75a047dfcd8883", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689769832, "uuid": "20865783-90e9-4b02-8804-cdecf237512e", "comment": "Malware payload (RedLineStealer)", "value": "7a08e2a624c497b3986fed503c84dd39612ab1fdda740280e5a1514c1aac802b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689769832, "uuid": "9d3e011c-90e8-41c3-9df5-7ba827979a35", "comment": "Malware payload (RedLineStealer)", "value": "c320dd1803bf38cd5822882b9c3aed0c0d2df000", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689769832, "uuid": "639ae864-45be-4709-b259-5506f3555dd3", "comment": "Malware payload (RedLineStealer)", "value": "3302ba20fca469a1942f013ec83c46066fbe820bf4e5cfa9e73305b149255d7fc8283b398de582713ce5a0e889f114b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689769832, "uuid": "b954eb2b-1c4f-4742-bdab-370aaa945b18", "value": "T117B41253FBD4A433EAB50BB114F317871B35BCA18978936B2741AB1B0CB2690653277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689769832, "uuid": "ac93b4ba-1372-487c-af94-dab8898c3d17", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689769832, "uuid": "4bbde9be-8ce1-4484-b562-39e3c93cfbf0", "value": "12288:VMrNy90LyyzBA8YCgPxn4VxjSadSX9zheZnSW:cykXgPaSadSX9tmnSW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689769832, "uuid": "dca97835-8631-44aa-8862-8537a3171198", "value": 526848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689769832, "uuid": "c7fa5a6a-d2c2-4dd4-ae5a-2924f74a7b58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689769832, "uuid": "c3655eb4-8c93-4906-9260-bcd7c7c9ba68", "value": "7a08e2a624c497b3986fed503c84dd39612ab1fdda740.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e7d2add-25e6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689738212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689738212, "uuid": "4fb9899c-97d5-4f24-a8e4-5221fa60679f", "comment": "Malware payload (RedLineStealer)", "value": "936cb3023cd500e07e9ad5dda9996c3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689738212, "uuid": "02936c51-1671-4344-8781-55f2649ab99b", "comment": "Malware payload (RedLineStealer)", "value": "7c533374288bae24f70e51c9b70c372e9d91fea2c51ce84903f47ea769fba83f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689738212, "uuid": "4f28e907-f6e8-4efb-9151-fadbfb4be991", "comment": "Malware payload (RedLineStealer)", "value": "5772bd98e8da65cb1339e45074b0a6eaf07219a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689738212, "uuid": "58cb0153-9cba-417c-b03b-1cbf2d01f8c7", "comment": "Malware payload (RedLineStealer)", "value": "01241c008a51733c2580316d4f18836dead0793bc4204859dddb4fbfa0a13acc19479650495215786061238d2e677d19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689738212, "uuid": "2a896b1b-77ac-46a2-9484-65fda07f3b3c", "value": "T17CF3D598364B667EC97F887D9C604CD0667CACA61242A7478C8EF0E87D3B7919F150F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689738212, "uuid": "eaeb3106-e6a7-4da8-806d-cb50513eecfd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689738212, "uuid": "7089e2da-350b-4eb5-b171-7169cedfe4dc", "value": "1536:obuR0C10WqlVZRGWyuHrTog/XzMXMQ8ys88888888888888888888888g888888T:PR0feoog/ZpyqVEUCidWT8F58e8hQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689738212, "uuid": "2917563b-52d2-45be-a412-5bcd4601ef80", "value": 172544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689738212, "uuid": "0670ecf6-d842-4e14-afa8-a6cf6bcc8437", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689738212, "uuid": "0f425595-9c5e-42a2-8cb2-2da5d32662b1", "value": "lux3.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29c66446-262d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689768591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689768591, "uuid": "a2d080ba-4f59-42a8-90e2-0b4bb30c6347", "comment": "Malware payload (AgentTesla)", "value": "f99f2e0dc7fb7af396aee4c7fee03152", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689768591, "uuid": "b3401626-b9cd-4fca-a08e-400d6ac0c382", "comment": "Malware payload (AgentTesla)", "value": "7d66d00114a19baf515b19caaa434a322dd3c5f88f015e69cffc0f0257f63668", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689768591, "uuid": "6a3552cd-5472-4459-87d1-9fa8290109d8", "comment": "Malware payload (AgentTesla)", "value": "2b244d69241b82d5a3efcd37d2abd5b90f3bb4c4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689768591, "uuid": "7ec676ea-d14a-4535-8c1b-912d1e5618f5", "comment": "Malware payload (AgentTesla)", "value": "13a0782c937e0cd66a8564ec1c0ebe1e74b4dd81c72db6dc9477619606a094ba939e20f9ef19e7dff6947581ae5f978f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689768591, "uuid": "acbd201a-88dd-4edb-8bdc-d031fa40020c", "value": "T1C9942304C7D19E2AAC8450B7EF24CBC850F23193A09E2D492B7C7D6D64EBC6E516E9DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689768591, "uuid": "a2c922a1-e5fa-4d4e-ac6a-d637ba157e51", "value": "12288:kDgXQu7SHOCZhSTIS2dGpeWpqivD1YxR25O8UN:klwarmMSAGMID1R5OtN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689768591, "uuid": "98f52aff-129e-4233-838d-aec5bd2f6e48", "value": 441219, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689768591, "uuid": "b9d850bb-5155-4050-ae57-23f78e3de575", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689768591, "uuid": "e4c19537-d9d8-4ce8-96cc-824f1b94fa50", "value": "quote [#30849021].xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d12f50f-2605-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689751389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689751389, "uuid": "71cad88a-ca27-4965-9084-708953d0b424", "comment": "Malware payload (AgentTesla)", "value": "b68d9c67917154772f0af78536d42f9f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689751389, "uuid": "0dfdeba1-4b2c-4eef-a1b5-1c09b097532b", "comment": "Malware payload (AgentTesla)", "value": "7dae16df2e64723a97b4c756fc2d5c307ee8b1234a47d7b8ebf1525ff5f2796b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689751389, "uuid": "19027a43-2282-4332-978c-267101b66834", "comment": "Malware payload (AgentTesla)", "value": "5a35756f4cbf573ea147b10db1fe49cdec0ceda4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689751389, "uuid": "c3d3c285-f9da-4361-9950-f4e4ecc7286e", "comment": "Malware payload (AgentTesla)", "value": "41713a90e6f2630910fcece0b2842fd7b28f8575f006dc6a9e51ca2ec277cff4fbe16ac27eaa80251db86a5486feae16", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689751389, "uuid": "ed7ae1f9-ed99-466f-b605-c32ef5d1ab2d", "value": "T1C6A423AF56224CA9EF6082F49C0F41B214D35C909E5D7EEF36B2F8AB3484E11D6914F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689751389, "uuid": "0b482a76-2449-4c01-81af-67d5151e91cb", "value": "6144:CpHYL0zRsoo+hBawX+hqh0kLFGCv1XkGAKRisMjVFiIkuMzTylVsOROYRdoiJ5jD:CpH3tZoInX80DLF7xkPviIFI8NYUJ2vy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689751389, "uuid": "23671f2b-4368-46b5-977e-f95e5328908d", "value": 451143, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689751389, "uuid": "7bfd7156-a243-4e9d-9d2e-016bc7f45917", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689751389, "uuid": "e4acdbd9-ac3b-4d29-8ed1-caa851d52ef1", "value": "IMG_Scan PO-EPDAs & comp POs, PSB-17398902, PSB-18384789.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ec3d7e3-25fe-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689748547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748547, "uuid": "dd843b99-d2a3-4d66-8b14-9938e5760559", "comment": "Malware payload", "value": "4045022d9d8a7c30bf9bfeb869316787", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748547, "uuid": "603b5056-f320-4a3d-aca6-c3d287dc0c3d", "comment": "Malware payload", "value": "7e8ed99814dcf4ed35bf9d0c6da35ab7241bc240bba422beb72ecea335a8d0a3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748547, "uuid": "0058f1a1-9586-4b18-910d-cdff7deee593", "comment": "Malware payload", "value": "70ff71011715546c8bc264b7a1174cc906c1cbd2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748547, "uuid": "b9cca0d6-711e-4eda-b5ba-6faf5b1951ac", "comment": "Malware payload", "value": "0a2185add8238d4c9f52cd438a960e8d49102644bebe0cc8d382c08f85ad6dd89b11d71b2bd9149d91f97025a4cdee60", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748547, "uuid": "f497e656-210d-4bf5-9a50-aae7fa7c3f43", "value": "T10A23E07655B2BF78E4F328718EAB21FC683EF03487134A2A45C023F7FCA125965516E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748547, "uuid": "a70049c9-5e1a-41db-835e-d53aa85fbec6", "value": "768:g2uYpslIdHqxYbGiQdQqTvO11ZWF+mAx7NhVsaVyKheI9VPnOABlSdmOWFah70uN:buOdHqabihvOrZ4EVVAAVPnO4Sdmja/N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689748547, "uuid": "313b4312-0360-4768-b9ff-537a59ec5d27", "value": 48264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689748547, "uuid": "4a27fe04-3e53-4f36-b02e-f569821589be", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748547, "uuid": "24e9990f-c33c-46d6-a89b-6419af94942d", "value": "4045022d9d8a7c30bf9bfeb869316787", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12a9a37b-25fb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689747077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747077, "uuid": "1065fb83-a360-476c-8cd2-e6de75d4c200", "comment": "Malware payload (Mirai)", "value": "7e0bedef93f047f0e4111e4cb927a4ce", "object_relation": "md5", "Tag": [ { "name": "2-59-255-213", "colour": "#A4F8B9", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747077, "uuid": "bc20110a-fafd-4c8e-b7d7-ffd74a14bf65", "comment": "Malware payload (Mirai)", "value": "7f156362c132d436cf7425e5f684857a9dccfc2e4fa9577233a42f6738a295db", "object_relation": "sha256", "Tag": [ { "name": "2-59-255-213", "colour": "#A4F8B9", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747077, "uuid": "3f97c159-8f2b-461d-ab82-25257c44a326", "comment": "Malware payload (Mirai)", "value": "a6d6194062632c618f95e31c2b2a8eb666661d13", "object_relation": "sha1", "Tag": [ { "name": "2-59-255-213", "colour": "#A4F8B9", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747077, "uuid": "9320fed8-5e10-4735-81c9-94762aa47ae7", "comment": "Malware payload (Mirai)", "value": "4fd80357ce99c2621e79ec5199d53e1b6cedfc42bbe9d79b4c33c148acd47c6e1669bb30652f118f1bbf4043e380cfc6", "object_relation": "sha3-384", "Tag": [ { "name": "2-59-255-213", "colour": "#A4F8B9", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747077, "uuid": "56d7330a-e030-4289-8af2-05b37cf4d21d", "value": "T1C1539D65C5AC6E68DA544174F614CD358723E408A5AB3EF6CA87C7A68007EFCF0497F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747077, "uuid": "561ce882-f5cf-48a5-b9ea-6e67f1e56d35", "value": "1536:1aIy6/Xc/0gh124YRS2TpfFSvdeTZmjeOeuWCg:1/y6Pccg6BdVkIN4eOeuW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689747077, "uuid": "3d63904a-e455-4c47-82ba-c6fbc6651bb4", "value": 64504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689747077, "uuid": "8471a0ba-7432-4419-874d-3366a580d24d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747077, "uuid": "08e2084c-a08c-4cd1-888e-7e46b29738c9", "value": "sora.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76aee240-2625-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1689765284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689765284, "uuid": "7f5f66e0-d59b-41de-8b06-ed2f59d96af1", "comment": "Malware payload (Formbook)", "value": "4f2d5f62dffe3ac0c990eb125dc21c28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689765284, "uuid": "2c5dc092-718b-49e8-ab2b-08ee004f5f5c", "comment": "Malware payload (Formbook)", "value": "7fe06d6a92d7557335e0b7fb8f79afad7f23a405ac1c476c1d151850348670d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689765284, "uuid": "d17f3300-aaa4-413b-b3fc-84877d8e908d", "comment": "Malware payload (Formbook)", "value": "1569a064ec6c96c52dc467dc7ad4ccafede496c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689765284, "uuid": "02ad34f1-4892-481b-a3ab-786b7f937f71", "comment": "Malware payload (Formbook)", "value": "f615ffc46fc188dfbea72f8223d785699274920ac162ab12879795c7f2bf5c30afebe9cabc79c6b115c5244810e048e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689765284, "uuid": "891032fe-1351-49fe-8383-c16ed3ea6b15", "value": "T1C444125869E2C0B3D6E317744F36AD5BAFE6EA11206A832F1B111646BF19381DC1EBC1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689765284, "uuid": "1754f011-09b8-43bf-a1f6-86ee9aecc847", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689765284, "uuid": "36cbaa28-d42f-4f39-936c-664785706df3", "value": "6144:PYa6k11XCqq5dVSFbbPwnariKsgbDKN8MJq+veqUtZf03Sm:PYibyH5dVSZ8na/d3KuM2qUA3Sm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689765284, "uuid": "c92719c0-58e0-4af7-8e76-9516939baf0e", "value": 262495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689765284, "uuid": "928ea2f4-6f9b-4c80-b1bc-b34a9faa71fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689765284, "uuid": "383b4c01-9c5f-4d63-bfc5-1c9febb3a18a", "value": "PO20231907.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f69a66e9-261f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689762921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689762921, "uuid": "38a3b32c-356d-47ed-80c5-49f44c9385c2", "comment": "Malware payload (Amadey)", "value": "1d9f3ea52a8b89b8ccfb9d703c7d33c5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689762921, "uuid": "4636c9cc-713b-4cf8-ad70-042b6c3953ca", "comment": "Malware payload (Amadey)", "value": "806347c33e4007046137819a7a108692563d6b877051ff1016faf9a47ec660f1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689762921, "uuid": "cbf6394b-8b53-44de-ad1c-9dda9d676680", "comment": "Malware payload (Amadey)", "value": "264636a7d26ccf2c82fd20d0f5917353815c85e1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689762921, "uuid": "a3f7bbb7-fa98-4ef3-afa6-086828272279", "comment": "Malware payload (Amadey)", "value": "12b7b3c28ed495a9983f6e5c6c993de3746e06c25980d8344057384c0f19f13d02b7e8a684751d2d6ea78f2b4bffbb7e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689762921, "uuid": "10220ed5-4d71-4eb7-b802-0d515319599a", "value": "T1CC84F143B6D89473DCB017305CF706871739BCA1ADB8836F2799685A4DB3688A53273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689762921, "uuid": "8c5154e2-f33a-4803-ba1c-0fc4958c8133", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689762921, "uuid": "3b1e033d-40d9-4ce2-9ca7-abf3cf3766c6", "value": "12288:kMrty900kaBTs4vnRH/sQpYD7cHnl9K+Nlj:Jydka535H/srDIHG+/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689762921, "uuid": "d4b33b48-a567-4c7f-b1fb-81bc7da03093", "value": 399872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689762921, "uuid": "df3a2ff5-df53-4a64-b8e3-60f01295d5d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689762921, "uuid": "6cfe2741-be65-42f0-8851-4a2428da425e", "value": "1d9f3ea52a8b89b8ccfb9d703c7d33c5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da4949a0-267b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689802388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689802388, "uuid": "3bcc11c3-31b4-4481-afd9-d956d079fb89", "comment": "Malware payload", "value": "5cf1d5dfccf890ef10afc5bdd93b15bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689802388, "uuid": "97b1f4e7-9792-49dc-accf-7bdaab8e9bf5", "comment": "Malware payload", "value": "808ff54f7fb199adb18413322e1e530742522cc083d5e1706c872b99a879439d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689802388, "uuid": "498ecd10-62a1-4d82-bab0-59e7748f8958", "comment": "Malware payload", "value": "3039624252e380f1598b9135a8031a9709208c55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689802388, "uuid": "b973f8be-6045-4282-ada9-7046d45389ae", "comment": "Malware payload", "value": "416f09cb09c51f42b36f1e88588b26eb92bcec620e4ce87c49c045b0dc63ad24feea193a24ec1cbbe0704407c78b33fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689802388, "uuid": "3c9388dd-4877-466c-82ef-1676f58682d3", "value": "T14344BF2137D1C472E46769300A32C6921A7BBCB3AB6581CB33943A3E6D717C14B79767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689802388, "uuid": "3e36c49a-f9ce-4b76-a8b7-c90081cc2e97", "value": "02f23a44e70611470e4c2107da6d7f64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689802388, "uuid": "a4f3abee-22d3-4545-bdc8-046e763b24af", "value": "3072:e93W+J5BQdRBID7D0CCa8uUeeMn2ctmGNdIylChuI0+MpLqPsM3:yWWQ3BID7RCaBcSYGx+MhqPs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689802388, "uuid": "edd67913-92b5-4094-bed1-087a3152294c", "value": 261632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689802388, "uuid": "8b45dfbe-7b2f-410c-9935-39759bb02e81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689802388, "uuid": "20e8130a-e14d-4d70-b035-2126b1baaf3f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62977db6-267d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689803046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689803046, "uuid": "24c0bdd7-9743-4742-9027-aa20de2b1c9e", "comment": "Malware payload", "value": "37c5bc16cd27a4e250bcb7f638fd08a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689803046, "uuid": "2a35eb92-a027-46eb-837d-e862bafa799a", "comment": "Malware payload", "value": "80c8d9c2d6ba81fe20a7953936491fa5c72bfdda9f443dcba5485db17c724210", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689803046, "uuid": "39a1e6a3-b29c-461e-9d53-fc1cca9d7636", "comment": "Malware payload", "value": "894382b3c64f3dd11f9e4be329d9ec27408d0b6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689803046, "uuid": "4c6adf7d-d926-44cc-a8cf-7b1607bc4b31", "comment": "Malware payload", "value": "8503db914821b7f09753f412f4db9daab4b2d51d197067922a2be6b35d6463f0dddd21801c60c83ab06a1d28108d47d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689803046, "uuid": "f19182b4-3958-48ac-8ce8-1711bcb65ff5", "value": "T14273BF82EAC45526D162223D26B13AF5AA74F5FA6201C1D976CCCDE5DFC2CB063363C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689803046, "uuid": "31b36830-0e6f-4836-a736-f35791821042", "value": "481f47bbb2c9c21e108d65f52b04c448", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689803046, "uuid": "643ea563-3b4e-4765-b145-713cad6cdc05", "value": "1536:IVT6zui20szqzYAVFkNyeN+IQOmEMb+KR0Nc8QsJq39:Xui20szqzYXfN+IPfe0Nc8QsC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689803046, "uuid": "fbc106dc-f500-4e50-b731-7fd6fc1eabc6", "value": 73802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689803046, "uuid": "57ecc0c0-6f1a-4057-b037-b08d927806b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689803046, "uuid": "16137fd2-4bd4-4017-b465-32c4da9c8c72", "value": "pay.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d75860b-267f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689803816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689803816, "uuid": "ccdbbdc0-a6a4-4307-8a03-a6cb853bfd71", "comment": "Malware payload", "value": "fae277d55c57c13857986f28d096a1f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689803816, "uuid": "c0f34b2a-ccbc-48fe-9b1c-28cf3f934b11", "comment": "Malware payload", "value": "80f8be7669ca52aec4c9f42385328b94069d6bbee35ce6352aa46216452f0d75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689803816, "uuid": "01b3325e-7ef3-4591-8484-739f6f258d56", "comment": "Malware payload", "value": "24815b4436ca85825ef05de9a72bd6ad1ef1b1dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689803816, "uuid": "89eb6605-65d7-402d-9b7b-838f873a674e", "comment": "Malware payload", "value": "ae56cddd311156a918e8be5ba83d95cae43f9265c7564f972bdab2177e06529fba5238585350e652017bc5d3a153e528", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689803816, "uuid": "c42b48dd-c683-4f62-98bf-c3a46725fa85", "value": "T18604D558324B69BEC97F883D9C600CE0677CAC661246A7079D8EF0E83D3B7919B151F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689803816, "uuid": "2ad8bf83-72bf-4cd4-8f4c-467871536455", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689803816, "uuid": "451f61f1-b475-4c0e-a510-4ca38db7156f", "value": "3072:hZDtYP7NEG/zYyxNmOjOyWdFlb3wQ8e8h0:hP6cvmWdFlb3wQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689803816, "uuid": "f10f9e82-2072-425e-8ed1-d2f89511817d", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689803816, "uuid": "5db5050e-1984-4c06-ae6b-5e160f31e46f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689803816, "uuid": "fc98a98e-f7ca-47e7-ad59-555240ec07ef", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf9adc10-25fd-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689748253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748253, "uuid": "3cf84c00-fbb3-40a0-a3a6-7bd069e0485b", "comment": "Malware payload", "value": "41f2d62aa6673c94b79f85ff4a0b74d7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748253, "uuid": "c791ecb2-479a-44b6-af1f-f3ed379a69f3", "comment": "Malware payload", "value": "816216e105973ea78fad9f2ff8646243f296a4be024d9b42c95b54106eb42405", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748253, "uuid": "f005677e-71ea-47d3-8d2b-e8baa48e8515", "comment": "Malware payload", "value": "dc7a1379f1c8783923dd9d6b7f58f40d1d4a5d41", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748253, "uuid": "9ebd3467-0dce-45fd-a2a8-4709df55c444", "comment": "Malware payload", "value": "864fe041102ce7a6c90fa7f356ab1caeb41e54541c2bbb5a0ede30dfdd07f5c83047b49399677c61354ca401a0cebd58", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748253, "uuid": "270b6be3-6507-4a30-a560-e16195afe55a", "value": "T16A336C027290C073EA6B053959AD96210ABF7C535BF890D33FEA064E5EB15D07A3D367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748253, "uuid": "fb12e76f-260f-4b42-a66c-368eb2affb01", "value": "48870ce7a0967218f26445c839c51332", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748253, "uuid": "fb889d6a-e0c6-412c-95a9-1e64b8d53ef8", "value": "768:Ua1ddIKxs2KWMDfatsbY22EQOWV2NKjKstyxdjlTtB0TkuC+n:Ucdd7FmfMGOKD7lTtBvx+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689748253, "uuid": "8fdc62b2-8ba1-4859-863c-10c00e39a925", "value": 52736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689748253, "uuid": "27b11dea-e000-48c1-b22a-4d6647fd9f0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748253, "uuid": "932a15d5-efd4-486f-b922-fd3c1de110c2", "value": "SecuriteInfo.com.Win32.InjectorX-gen.7710.13668", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d12fbafa-25fd-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689748256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748256, "uuid": "9d15e8f5-6d00-45df-9ace-53e7d0a8cc8d", "comment": "Malware payload", "value": "e240198d90077de038fe6cba00418af4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748256, "uuid": "fc99b229-0445-4d2a-b43e-020772fbcb76", "comment": "Malware payload", "value": "81a724b6054739835eaf16d71416b38b5b86011d10bf7432f1b8734aa6531a2e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748256, "uuid": "c95e7b16-4497-4368-94b1-1562c7aadb90", "comment": "Malware payload", "value": "c9c9e68256f7d35cd774828de5dde15e697847ba", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748256, "uuid": "6f1b2019-4aa6-4f40-8da9-271e5bc51cc3", "comment": "Malware payload", "value": "05a1028c0c68388dd13bc21460d40a1e9afc5cb9c200601342f0597ce84da53589be8f2101904d480eb597426c8c1787", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748256, "uuid": "13998c25-bec3-4bda-b992-d54c11cf1847", "value": "T1C8338D05B6A0C4B3D5AB063918AD8622067F7D635BF484D33FAE064E5EB15C0BA3D367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748256, "uuid": "4abf9938-c749-4b50-83be-cf4c7a984509", "value": "48870ce7a0967218f26445c839c51332", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748256, "uuid": "116a77e6-7501-49f2-8cfe-e4cba7a19696", "value": "768:S5wEURWk/LkUNz5bYOeEYX0HWV2NKXKstyxdj6TtVQ98lLmOxj0vj:S5wEU3wYfCKD76Ttec4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689748256, "uuid": "09728f29-2009-431a-8484-ac43be49ce48", "value": 54784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689748256, "uuid": "6c4af19c-09d4-4933-86ed-1b3bce6ced91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748256, "uuid": "281ef57a-e192-4ed6-ba1d-a9cbf4059dd6", "value": "SecuriteInfo.com.Win32.InjectorX-gen.6514.14209", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c8176f7-25fd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689748060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748060, "uuid": "5209ad76-f21f-44b2-bbc4-72a4d5c401af", "comment": "Malware payload (AgentTesla)", "value": "df606fe971644d0987c01da868958b14", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748060, "uuid": "3f327db1-4ec8-462f-85b7-a71cdce92cef", "comment": "Malware payload (AgentTesla)", "value": "82aad3f0558068a0e5490e7183d6199215106028e0b596a955d8eff0a0a18c20", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748060, "uuid": "fa030bb5-548b-45a5-9dca-c90f1359de8e", "comment": "Malware payload (AgentTesla)", "value": "6d5d503882e5b3001bbd463f3997d92b3595fd9e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748060, "uuid": "4b491b2c-1469-4b0f-8cbc-2e6c99aa7fed", "comment": "Malware payload (AgentTesla)", "value": "fa7bb0ed514634121cfca3e17cfb1b77b4f8eaac2883ec405a6acf956bb38897a023e6b2af070cff17e4f433418e4e23", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748060, "uuid": "63a4e354-fe51-4585-8be8-08bdcc608b18", "value": "T1AA0422357FE28567CAAC4FF0D432B5590366E7B90D0ACF8F9C88530AC99E1ED620159B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748060, "uuid": "22b9d75e-1504-4039-b73b-28de88029cc0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748060, "uuid": "ff6cee87-712c-4901-ae10-61fcf8275230", "value": "3072:jPKlD1IuYQ5RUsddlWhHAc6ZodPtBMCdmHZnR3ovDeem7vdR7zztYProee2:u11ObHA7ZodlBBdeoDeemL7/yProe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689748060, "uuid": "cdffc40e-6e39-495c-a101-3d934a0145cd", "value": 186368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689748060, "uuid": "e0a1ca92-57ac-499d-9210-374d32b9d46b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748060, "uuid": "51e158d9-e8ac-4111-b5f8-d736020bc1cc", "value": "e-dekontpdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1f6970b-25df-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stop)", "timestamp": 1689735318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689735318, "uuid": "3896d8a4-d3c0-4e82-a180-08d96f6b593d", "comment": "Malware payload (Stop)", "value": "a12e3ad55dd6ad4a92df8fd230a5d215", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689735318, "uuid": "8c385809-2fad-4a24-b8f3-7606b758a772", "comment": "Malware payload (Stop)", "value": "83ffcaeaafe5743a26789febc54403eed563af8a47949a7b956cbc93da601331", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689735318, "uuid": "e9b0e682-3ae5-41a8-93a5-9e84c103e525", "comment": "Malware payload (Stop)", "value": "3acb64b4ada51c248212618ff3765f5ccdc0013b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689735318, "uuid": "a70d0796-b8ae-45e9-8727-a19c7ef9fe04", "comment": "Malware payload (Stop)", "value": "7117d1342fd675781985b2010934eb28735669067fe5e17072744883296685a17d676eddb4c37d942b53ed2962953b6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689735318, "uuid": "46945032-1ee0-4983-9738-5a23b29b979b", "value": "T124F4122127F2C0B6D5774A34097586E25EFBB96217B184DF3368126E2E307D08B7C76A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689735318, "uuid": "2cc67978-ca60-4e7c-ae86-df965dacf80d", "value": "975381942ccde8d218bafa7330ae3283", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689735318, "uuid": "0ae6c7da-e972-424e-bdf6-266d6429331f", "value": "12288:R6pfR5RwXDO/cXFCooy4pTpff6L402amkH8jq2m2na40wTbjogi:REhcjX/KlCL4ba5g62J0wXjoZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689735318, "uuid": "cd5bf378-04c4-4ea3-8176-de387a44f1c9", "value": 776192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689735318, "uuid": "3e18c13a-ccb3-4c28-9f67-bdd1cdafa233", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689735318, "uuid": "529a2caf-936b-49af-ae9a-71124e57c537", "value": "729.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f02a8b87-25fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1689747878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747878, "uuid": "23fc9a68-13d8-4b2c-98c4-51336db93182", "comment": "Malware payload (Loki)", "value": "01d35baefe1ce38feffe07104ddd27d0", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747878, "uuid": "c36b16bb-7a04-441a-b024-58a09ff55ce6", "comment": "Malware payload (Loki)", "value": "84750ac6287c0ddb3289f197247bf4cd8e06ff9656e5b7355aa8adf37c28f7db", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747878, "uuid": "458c3806-c771-4878-b22e-9761f8800d7d", "comment": "Malware payload (Loki)", "value": "aa59f404015f4cb46fe2e607d2fabde040afefd7", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747878, "uuid": "d2723df9-ad27-4f9f-9811-49bfccd68310", "comment": "Malware payload (Loki)", "value": "1228d55c2a3aeae9c4eb072f2b198027dd7944343d1b3f01104b8857a425d822fe2de7d599fc102287b9b76f02c24ccd", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747878, "uuid": "0e706186-60c9-4014-ae4f-1a62ec4e0ad1", "value": "T155051212FE80995AD80247305DE36197851ABC537EBEE8836487B7CF05B2FE0A533B59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747878, "uuid": "25a179f1-24b1-4608-b0e9-2fdd6ccf7670", "value": "12288:0vOij8V1UXqUu9Vner8VdArmmPwUXnJiRCAbocwV1WP5K8cLnGIOsCUlwGIx:xeu9VxpHpbocwTA5K8c1FlwPx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689747878, "uuid": "b70c8b6f-6da4-4c2b-8f4b-62a7b50f2b9a", "value": 821760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689747878, "uuid": "3b8b90c7-a6a4-4e73-9ee4-6632687a9e6f", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747878, "uuid": "18b1a96b-0d2d-4196-a87a-51c3f5e74b23", "value": "RFQ.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59a104a4-2659-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689787569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787569, "uuid": "1daaeadb-144a-4db0-ac21-6ba0863e6257", "comment": "Malware payload (RedLineStealer)", "value": "91a0106c0b58cd6fde7a66bb181b3dbb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787569, "uuid": "cfc511bc-b065-4524-97e9-2396c6d632f0", "comment": "Malware payload (RedLineStealer)", "value": "84843ae0e91bbacae720437937f1bcea3fcae4d9933d71a07a26a8e81479c0f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787569, "uuid": "d8217894-dc6d-4b87-8a08-d6f1503c813c", "comment": "Malware payload (RedLineStealer)", "value": "17bdbdb35a47154fec7fdfc4e9f59a053e5d5d7a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787569, "uuid": "04410f47-5dab-4cca-9355-69f5753c9986", "comment": "Malware payload (RedLineStealer)", "value": "ffa4f081e6e352259768b21fdd58dba38ae54b772a0647e41d754395bb9b28cbf88a50c287229ef6aed475ea0507d3e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787569, "uuid": "9ff492f5-831c-4ad9-9050-32113d94adc1", "value": "T1E874E02236E0D073D7776930093192A12BFEBCB15B7200C727582A3D2E707E15A76B9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787569, "uuid": "265dbcca-6878-416e-86a6-07e0babb6f48", "value": "b64d2f93bd8f1bc9d27e80e5b6c25b2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787569, "uuid": "504cde2c-4f5d-4b40-9d02-f75da6803f85", "value": "3072:AP2ZBBNQdf3BgVy/pC35i/fcax7YN9+SVtkwFn1oOKlOvJO2bNLg3r3XN3:zZRQN3Bg0GincaGhVtkU0sxOuq3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689787569, "uuid": "b6201fc0-b52f-4412-bb07-7e3a8b8dcf12", "value": 353792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689787569, "uuid": "a35514f6-2b0c-4ca2-b54c-89ee9b6746ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787569, "uuid": "0bcd501f-a72a-499c-ae69-88ebbdadcaf0", "value": "91a0106c0b58cd6fde7a66bb181b3dbb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bbf02ee-25ff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Tofsee)", "timestamp": 1689748944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748944, "uuid": "08feb00c-c88b-4887-97c2-115464ed9141", "comment": "Malware payload (Tofsee)", "value": "52dc0d2bae712c4cf108bb3a91b46239", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748944, "uuid": "d670dcdd-7406-4a07-8ecd-babc23a5e310", "comment": "Malware payload (Tofsee)", "value": "84e3ea97962efc6024e23111919157b32b89973f2e375f0fdeffdb8af229a1c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748944, "uuid": "09e4302a-fa50-4a30-83d7-19ef312bf605", "comment": "Malware payload (Tofsee)", "value": "9b5f1f86f7c51825e9653fa66166099238e1dfdc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748944, "uuid": "41ee5f38-0508-4a19-9ac6-7a5301311908", "comment": "Malware payload (Tofsee)", "value": "8ce2b492b4ff9fe21e92dc861ac9bb874050798d72ef7205526d445b49816e154598a34934a2f3a71f0d828a588c5218", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748944, "uuid": "032edd30-2b20-4362-b1b5-b6bf23e24d2b", "value": "T12A54C74B92D13D54E9268B729E1FC7EC770DF6508F8A7B695119AA1F04B20F2E1B3B10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748944, "uuid": "bc5ede76-9ed0-40f7-85a5-1c03d47a28b0", "value": "b1052175a8ad7e15972137d39fc65ecd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748944, "uuid": "2c3dc792-d22c-4115-9caa-693088b511b8", "value": "3072:TPp0RgqzCoHLVnS1AT7BGjFs9g054ieGrIqoh44Lbnl5SRenyZf:DIzCoHLVS1OBGjFs9bh7oLbKY0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689748944, "uuid": "5e0d4d2f-0b8a-4ce6-b1ea-14287daf87cc", "value": 288768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689748944, "uuid": "74a98228-454b-497d-893c-2697bf0147e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748944, "uuid": "da005837-f2f1-4458-909f-a59bfd92fb07", "value": "52dc0d2bae712c4cf108bb3a91b46239.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77dde9cd-260c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689754548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689754548, "uuid": "5e308688-4bda-4726-83c4-1b6b69503a93", "comment": "Malware payload (AgentTesla)", "value": "6c69b1778096564e9926f9cab8600031", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689754548, "uuid": "ea7eefcf-9750-481e-bf53-87faf227a0ca", "comment": "Malware payload (AgentTesla)", "value": "850ce005298ab95b563a50c0b95618d97bc4696e3fffddf12b06c25bf933bfb0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689754548, "uuid": "e1e1223a-9a6c-4384-82cd-792e5974a217", "comment": "Malware payload (AgentTesla)", "value": "39592861740092bbfe0bcb632b0bc55fbde58ab1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689754548, "uuid": "34eb07c8-564b-489e-9fdb-a1f764508931", "comment": "Malware payload (AgentTesla)", "value": "60ad5975ec2f4e317b7e4b11092c5d1f92acfa5a016f09427b7161d9b73dd91e67ea71a4dce107d4b7b68a6f27349d16", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689754548, "uuid": "4f1828fb-f057-45f2-b155-2db21bc3271a", "value": "T163D422545BA88523C0F923B86762A3A183F2CFD85858E34E5FEAFDC0B55B74412497B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689754548, "uuid": "bc2e6b59-3521-4742-bd38-403dbbdabff1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689754548, "uuid": "d10e1271-4540-4a72-ac21-42191154fb82", "value": "12288:hPYPfY7fsbKjfK9yK2kVM7Ta/UO42LMW2lNDCxNZP:hPYPgwbKjGyK2j6UqMWENDk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689754548, "uuid": "9e303eb5-0729-4ffc-b1f2-9dea8299449f", "value": 638976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689754548, "uuid": "f3e145ce-05e7-44b4-bb4a-8fb16bd7b462", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689754548, "uuid": "08495143-8792-45b6-ba62-10cc797182f1", "value": "Transferencia.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46dd41e9-2630-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1689769928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689769928, "uuid": "b704b40c-0e63-4ca9-b4ff-55e8831ca590", "comment": "Malware payload (Formbook)", "value": "01ab89bea7c51c04e476b34a87efd9de", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689769928, "uuid": "18dda175-d03e-479c-bff2-9fdf4d34cf96", "comment": "Malware payload (Formbook)", "value": "851344fd3cbeedcc94a4d187549bb019a9700a3eefa2cf3741089056fb7556c4", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689769928, "uuid": "4cae1522-19a3-42c0-afbb-1655c3f24509", "comment": "Malware payload (Formbook)", "value": "c33acf0c2c175e8e0b35f42304852fdee82db680", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689769928, "uuid": "d72b0cee-9359-47d8-996d-ad7d4701a106", "comment": "Malware payload (Formbook)", "value": "e075d1eaa4abd488afb7ddaa2a07705e74369c023abbbe55ac8dabb87392999785101f3a065890d51dd97abd6cb3fad9", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689769928, "uuid": "e6560764-172b-4fdf-aa27-c289baa91c1a", "value": "T15835BFFC76047DE6267F176BDA96ADDC03A61A6299CBA4CC8064B7C305A3375FE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689769928, "uuid": "c890284c-b784-479c-916b-dd0e16efbc85", "value": "24576:TcXDApUYjyewDOYjY4jzjdUNQBQfl1eAqktDn0tq/BuIS4pvBN:l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689769928, "uuid": "af815444-49ed-4007-8ef5-196ec56c91ff", "value": 1080600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689769928, "uuid": "6c07abf1-f75e-414c-a285-dd9abe9d529d", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689769928, "uuid": "ddde511d-3d09-4c1e-96b8-a4cbb2b0fc32", "value": "INDUSTRIAS PONSA SA CATALOGUE & PRICELIST JULY 2023.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d886a79-2627-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Hydra)", "timestamp": 1689766127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689766127, "uuid": "f575a864-2920-4809-a7c0-21b29b477890", "comment": "Malware payload (Hydra)", "value": "344e523962f17cf9af4c5e7a7f11ef0a", "object_relation": "md5", "Tag": [ { "name": "android_hydra", "colour": "#626579", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689766127, "uuid": "3b1c888e-25a9-40b2-8bc9-1835e38ade17", "comment": "Malware payload (Hydra)", "value": "855c03fb9cb069d04ffc33626e3bff7a4913fd036e08d0efcbe0e17f3706aca3", "object_relation": "sha256", "Tag": [ { "name": "android_hydra", "colour": "#626579", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689766127, "uuid": "66320655-233f-4eda-bc11-e4a145f9ad49", "comment": "Malware payload (Hydra)", "value": "7e2700c048a4d644d6fbb84d62cf6d3d16cd45e9", "object_relation": "sha1", "Tag": [ { "name": "android_hydra", "colour": "#626579", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689766127, "uuid": "40a404df-fb65-4661-aef1-d90ffe4922f4", "comment": "Malware payload (Hydra)", "value": "4422db2538b64564abb343d834f96f8dce61e4e0615157a3b2f10c9800c2967c1a54f25ce2fa3bd204e3be35a3a24ba8", "object_relation": "sha3-384", "Tag": [ { "name": "android_hydra", "colour": "#626579", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689766127, "uuid": "1d8db118-2d09-44b2-b800-bfe10170ee50", "value": "T18D163345B5D06252CCBD4B794D6B9B8802A77E18CE53F21F6165332E16738C49FA02EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689766127, "uuid": "46c1b3ad-ed4f-4d95-96f0-5f6b3c02ff8f", "value": "98304:HbbymkuCoamhqZ/xEjy0h1mp1GxEL4z9kx1ihyxi/hYgsq:HbhkuZa5Z++0h1mpFMze1EhYgsq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689766127, "uuid": "3cc0e77d-1ea9-485f-bd09-36758392746a", "value": 4044320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689766127, "uuid": "e2ff5056-53ff-4502-a688-4f83d4fc9514", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689766127, "uuid": "bb55a71f-f6d4-404c-9673-c93371096c2e", "value": "7-aligned-signed_en.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3424508f-2633-11ee-a6f9-42010a9c0055", "comment": "Malware payload (WSHRAT)", "timestamp": 1689771185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771185, "uuid": "3dab5d69-2b9a-46d4-a51a-6ca74baa7fae", "comment": "Malware payload (WSHRAT)", "value": "bebb7261224b5a20938c5b0ece1e973e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771185, "uuid": "44c7b96d-d9b5-4f76-a85d-ae4b42afae02", "comment": "Malware payload (WSHRAT)", "value": "85682ad2261aa1d7d9f56f3e7dfb963cb2e15fdecbd8bcf4c6c2443aa470108c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771185, "uuid": "6301a6b1-dd30-43e9-a477-05288794a9fb", "comment": "Malware payload (WSHRAT)", "value": "7ad65629b20caaaac52b7a161c8be6b5ebb9e278", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771185, "uuid": "09ceb5e4-1f62-446e-8745-08cc75aa2f50", "comment": "Malware payload (WSHRAT)", "value": "6474d3a0ced34ed470dd1fcd7e151315bb6da995ee6ba38305a87124ea07b9dbbbb7ff7db45347ec40b1bd67414f8140", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771185, "uuid": "f664976a-976c-47f5-8d90-df1ca6d6aedd", "value": "T1F025D5C32549AAB6F3F3E645C3555B172A28C29B1A1B20117AC23E4CDF5ED442EF89DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771185, "uuid": "d9c5ff57-919b-4e34-ae45-849b80ee8aa7", "value": "1536:qeqxR3RFiK5t/+2Z20xYssK3Qk5Fh5dQt5U6EPkQcTeV8qMXKQcTeDwxAiPvcYnS:Y7A977i8YnIvf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689771185, "uuid": "85a58316-ac9b-4033-8a88-31ebcc9a6608", "value": 1036034, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689771185, "uuid": "149809e4-a721-48ca-8129-036393979df8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771185, "uuid": "006d85ac-1675-4bb8-b6b7-be85d09efbee", "value": "TBTX00392.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b60d8aa0-25ff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689749069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689749069, "uuid": "1b96a175-7682-40cb-a353-05fdaef756a6", "comment": "Malware payload (AgentTesla)", "value": "e539fd8fa4abe006c864acfb5018a463", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689749069, "uuid": "0091a256-e96e-41d6-a6bf-59e01e892932", "comment": "Malware payload (AgentTesla)", "value": "8594206acf3c9774c30220d3d9c3bb9f2e2e26faab7b7e8faff25d2087bcfcb1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689749069, "uuid": "70a39d43-058c-4ea8-8671-5323b09657d3", "comment": "Malware payload (AgentTesla)", "value": "d3b2dbb022a2ae4ac1cf9dc9eeca770c180ae6e4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689749069, "uuid": "e634f948-a816-4671-8471-dff1f5c5aa22", "comment": "Malware payload (AgentTesla)", "value": "af03c1ad3386bd0154715fd1c546fec0b12eb3dc86b73a8750307b814cc615d78ad31aa2dc1fc0c46349744ddd9b3682", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689749069, "uuid": "37dcaefa-c418-475c-8931-a8144fd29a5a", "value": "T193328F3A88D9ACAED30B14B640A93204F6E560C37239B90E7A70F955C5771EF7A02394", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689749069, "uuid": "1e816923-4066-4c73-9283-f77600153875", "value": "192:yya0NqsreWwARgZVPCK44AG9xXSJ+Ej7uJYcKwRKmfSWYKcWemF9cY:yyXqsreWwANK4499xXSJf7uJYcjxYKdX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689749069, "uuid": "5c5f7f61-8fa9-464f-8f0b-825d97daac64", "value": 11083, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689749069, "uuid": "8dd0c58d-40a0-4f33-b955-2a9272edfba0", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689749069, "uuid": "cfd76a96-4bc4-4796-8d26-847333c50695", "value": "scan-75748595.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a7fc46a-2633-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689771115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771115, "uuid": "d5462c6e-1319-41a7-a27c-3831a19a75d4", "comment": "Malware payload (AgentTesla)", "value": "43d9da31ffc1eba46308d07fac15b80c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771115, "uuid": "2aeaadb6-835d-4ab4-8b71-170248474238", "comment": "Malware payload (AgentTesla)", "value": "872f77272de453f6fa432568b70c861d40911344ded71477faa8895bfdf36fdc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771115, "uuid": "9e45495f-dd3a-4edc-8bde-88b87c35ec48", "comment": "Malware payload (AgentTesla)", "value": "83722df944ac2c874fd771ee578ebe7c20ad6f61", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771115, "uuid": "8ec7a967-1161-4a9c-b9c4-4bbf56d2c791", "comment": "Malware payload (AgentTesla)", "value": "511af25ec47d731f5393de54cde586261baea07363f39f2613907981e0ed62f1ef980bd50f50c719dd76f61b64881466", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771115, "uuid": "028fe510-c983-4e6c-9906-18dc043255f2", "value": "T16064130D62A4D323ED930BF31EB5599797B6DC1A15B8E34F9310EE4AFD30582860A772", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771115, "uuid": "057357b7-b790-4e1d-ab0f-a96790b1177a", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771115, "uuid": "40c27e8b-748c-49ad-9239-8e4c761bf176", "value": "6144:/Ya6scAFXQnieFNIgeHv8uHyQ11ZuplNS/4FUUEWW2URklmchhVN/0:/YqvSHIgeHv8q1lUEWW2UylmAVN/0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689771115, "uuid": "a78f2f43-7725-47fd-b85f-933370fa1971", "value": 324090, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689771115, "uuid": "870f3c73-1db1-4e5e-8695-437573a57901", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771115, "uuid": "e758175f-3219-4bf9-8c1f-5887f5408321", "value": "FEDEX_AWB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e2b8f70-25df-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689735285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689735285, "uuid": "1ad62303-dc62-4f27-854e-d15cf7b2ad98", "comment": "Malware payload (RedLineStealer)", "value": "992efd29479acb4bd68434263df3679e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689735285, "uuid": "c6a0b1df-bd2b-4027-a210-3807a6b41e90", "comment": "Malware payload (RedLineStealer)", "value": "87dd86c08e7295181b62c9064b0757c78fc685464cafdba39bc292b648c01edc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689735285, "uuid": "f11257f3-acb2-44a7-8f38-d815e2525418", "comment": "Malware payload (RedLineStealer)", "value": "5d0047e71c5f3d2a8cbfbac848ac977a48f4158e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689735285, "uuid": "7673bc41-9afd-4b73-a2ee-9b8a97d93202", "comment": "Malware payload (RedLineStealer)", "value": "69d1dc8e148117c6bf75e314be5f55e9e806be8f276b6fe11dc79a3accc6f5032ba60ccf9f87973607c312d2805cac6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689735285, "uuid": "9543eefb-f3f1-48d2-9a41-608241251cde", "value": "T14455AE006454C715D42CF8729473DF899A98A63C2B3FB5608BA41BE2BD3FF5C826D362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689735285, "uuid": "0986ed61-6937-4574-9224-48fb2bf825e6", "value": "372e4e4870a9f350530e0a006218a951", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689735285, "uuid": "ceba76f2-f80e-4bca-a74f-060f4624285c", "value": "24576:43rV0wJVBLU8IOSUReWB/EUNDlOHl907GzDT1cZnIYFhv7i6XKeLKlQTJdl6EJmW:4lVBY87SUReWyUGI70TuZnv7XuidlvJ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689735285, "uuid": "17b2d763-5a0e-4f8a-a96f-ebb2e4866d9e", "value": 1374528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689735285, "uuid": "c4766303-f8ea-4eb6-90e0-c396f684d5db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689735285, "uuid": "c11a26fc-6221-4055-b891-e641fc96d787", "value": "4TEQ.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ed1bcb3-267a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689801724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689801724, "uuid": "8ee51c04-ee89-44e9-bc54-dd51b0c518e1", "comment": "Malware payload", "value": "bedbe012a1b5826fe7f1dec74b63b729", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689801724, "uuid": "e8875721-c881-4865-8b60-d4390eadd27e", "comment": "Malware payload", "value": "88b9fabd26abb085ca896c1f28205fae662d1d201ce50d737d46faed26c8ee0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689801724, "uuid": "3eb4881d-6d65-4e82-9b1a-5f2216ffdad5", "comment": "Malware payload", "value": "712abd64fb091b73a0618ce5c0246693051d43df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689801724, "uuid": "629bee0f-9081-41da-a1df-ba05e1f88c4d", "comment": "Malware payload", "value": "7a388b0725347c1c8adec2a71f1a2567ab9893e61f61209567a7a43a8bdb862d1622f2fb87c7e74588267736b54f4769", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689801724, "uuid": "d8a60927-eda0-469f-a991-242739f9b02d", "value": "T12D74F1127A90C072D46BA9300A72C6561F7BBCB1ABB501DB33543E2E6D706D15FB878B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689801724, "uuid": "1ceed924-a41f-43e0-92d0-4887789c8edc", "value": "02f23a44e70611470e4c2107da6d7f64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689801724, "uuid": "d5d34e0a-b953-4fe6-9f43-86ef7e20d56a", "value": "6144:7HwJQcGnN+jVGXmaxL+kPxJl0kvJmyAo5L/lsnBBl0Yt:7tcGk4XdPLlpJmlol/lSp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689801724, "uuid": "68008e89-4605-47ee-9088-8cbc63225da2", "value": 353792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689801724, "uuid": "f1cfeaa4-f0c4-44ee-8120-53439abae2cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689801724, "uuid": "c0c495bf-44ea-4ab7-a90f-0c6ed9377e01", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa01cd61-2606-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1689752190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689752190, "uuid": "0a5d8dc1-b212-41e0-bbde-73d701db30d9", "comment": "Malware payload (Formbook)", "value": "a79a555d8074362ce42e03465fc6655d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689752190, "uuid": "d8eabc57-bf37-498a-925d-804feb7f39e2", "comment": "Malware payload (Formbook)", "value": "8904fe72b770215a4e3bc82f6e1fda9756a147fb86bdac2fec7ebac577866764", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689752190, "uuid": "9ce0f5eb-b7b8-4e0f-ae6f-6fbc9c6e67e4", "comment": "Malware payload (Formbook)", "value": "3acabb0dbb9d88b388e0b068c98c53605de367f0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689752190, "uuid": "c83c3da9-9f4b-4d16-bafd-63f429b5acf3", "comment": "Malware payload (Formbook)", "value": "d210bbcb87a6b2c422842202dbd43d5a6aa9cd9f56e4257bbe718577e87d0cdc8febc790b51e2f25fa40b0183e5d6ed9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689752190, "uuid": "b89c4fe3-3d00-46d7-92e3-90d98eed50a6", "value": "T125251225B0C2C1B3D977017044D6CA6A9959B03A1F75D6D7BADD1A7A6F203F0A3382CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689752190, "uuid": "007ecb84-067d-4a95-be3c-3b2c316ccd71", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689752190, "uuid": "9079d8a9-8393-48ea-a5ba-eaee580c22c6", "value": "24576:Hk70TrczzmYJqlHIJYhO2VVP1ru6DGt1blxIj:HkQTAzztJcoKhOgVP1rjD417Ij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689752190, "uuid": "a4f5262b-1310-41d1-a7fe-d8aa508e54d9", "value": 974336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689752190, "uuid": "4be7da48-f3aa-428c-aaae-c0fd63b306d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689752190, "uuid": "e799e431-97c5-4a2b-9a7c-6276b33b5f62", "value": "a79a555d8074362ce42e03465fc6655d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f11ae6e9-2602-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689750457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689750457, "uuid": "eeea93cf-cde2-4275-a902-660771c66352", "comment": "Malware payload", "value": "6be66e1a53e095a948053e6931083b27", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "ticanews-com", "colour": "#FB8398", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689750457, "uuid": "176cd1fb-4857-4e82-ac96-81dfd06f55f7", "comment": "Malware payload", "value": "89c368373bb379dd321f94139fb335a71e25ded40333b8d1a4bedeaa5fc650e2", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "ticanews-com", "colour": "#FB8398", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689750457, "uuid": "f272ab07-3473-433d-aaec-0e52f5654af2", "comment": "Malware payload", "value": "6c6aa858de9157583b3c304210bb7f3abeac3b93", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "ticanews-com", "colour": "#FB8398", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689750457, "uuid": "4e91c0ae-a36e-496a-85fa-10040713f042", "comment": "Malware payload", "value": "4c0e4a2eb3e758c0f39a77d4dc7527f312282d80eacba202a6573ab86a32054c79fe5ca7f0b9958383a5184b6d70d69c", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "ticanews-com", "colour": "#FB8398", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689750457, "uuid": "903ce271-6912-47e5-8bbc-3251b82e2309", "value": "T1963124141EDA1724D3F68E3694BE7315997A7817EE924F0D018156882862610F8B1E3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689750457, "uuid": "1d2c3a86-81a3-48e3-a1b1-dc4e158bd0db", "value": "12:8MW0m/3BVSXzZUBW+fjEEWIlA/iCyYV52bLn1Il+MY+L1vP3iN37+lbYo1q90r8:8NJ/ByUA+fwFl6CIY+kL1vurabNq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689750457, "uuid": "53427af2-2938-4b50-aee7-7facf856abd0", "value": 1674, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689750457, "uuid": "8f44e9e8-7852-4e51-98fc-1d4f52b7baaa", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689750457, "uuid": "4a32d02e-935c-4968-898b-85e4f7468d42", "value": "pdf lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a163d7d5-25fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1689747746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747746, "uuid": "254df4bc-1571-43ce-a289-180d30f64ff7", "comment": "Malware payload (SnakeKeylogger)", "value": "886fab64c6bbcf0791e49b5c030a8c99", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747746, "uuid": "34041c3f-1d82-4795-8452-fc3a9916aa86", "comment": "Malware payload (SnakeKeylogger)", "value": "8a22014ada2999b66ab041f0aa93f42fb50b481778ce709272209dc9a96a9135", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747746, "uuid": "61555945-da45-4de8-af6d-1e4576b4b019", "comment": "Malware payload (SnakeKeylogger)", "value": "7185f370d3fe7b50e75a3b108f24576bb4fe07bb", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747746, "uuid": "9cc2030f-af0a-479d-a0e1-782a41c360c7", "comment": "Malware payload (SnakeKeylogger)", "value": "2a70fa44ee3632faef2fa3f70319d45c2563a28644dc558dddd4dfd85d1216df9257bcca5005bd9bd58ce75800269e9a", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747746, "uuid": "07e0c027-388b-4fd4-bd4b-160811c78414", "value": "T105D41210B2A4C72BC0BE17F81BB05B00437DAF96A962E65A8F87FCC575777815A41A33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747746, "uuid": "7701daf6-a4b3-4503-98d9-28f870f07d8d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747746, "uuid": "4810acfe-9724-4ec4-a38c-bcd68dc86f05", "value": "12288:VPYPfY7Q+N3y/VmTcMub+c1buATna6do3wKCMKpcDAhe:VPYPgdN3ypZb++6ATna6dYwT2Ahe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689747746, "uuid": "2b4c8a3c-9304-447c-97d5-9f3d0f752219", "value": 607232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689747746, "uuid": "ac2cba19-5a14-4c80-b9c9-2d3af89d2db6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747746, "uuid": "43627a3b-941f-449b-aff3-d450a015654b", "value": "DHL AWB 5016240032.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fbbc79a-25fb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689747072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747072, "uuid": "ef7c12a2-78db-4cc2-9323-eb341961460a", "comment": "Malware payload (Mirai)", "value": "dc76e1a503496f00babb57cd689ba551", "object_relation": "md5", "Tag": [ { "name": "2-59-255-213", "colour": "#A4F8B9", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747072, "uuid": "270d88ab-5c14-4b51-ae52-9a46c836cc1c", "comment": "Malware payload (Mirai)", "value": "8a8f738293814fa034057d52fb248769271e098ec4e7bc90ca5ef77684a343ed", "object_relation": "sha256", "Tag": [ { "name": "2-59-255-213", "colour": "#A4F8B9", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747072, "uuid": "60f6c38f-b51c-4ff2-9e17-2223babce49c", "comment": "Malware payload (Mirai)", "value": "7ec03d1252cee3c7e6e274b9fdc061ec8b45ee9d", "object_relation": "sha1", "Tag": [ { "name": "2-59-255-213", "colour": "#A4F8B9", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747072, "uuid": "0797f31f-e7cd-4eba-b6db-7e57bb0a0b99", "comment": "Malware payload (Mirai)", "value": "c5b017412a15fc496b90191fc6e7acdfd69bd863519544dcb6283ca1f50a94a6d341c1c54891c39521718c59522c1113", "object_relation": "sha3-384", "Tag": [ { "name": "2-59-255-213", "colour": "#A4F8B9", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747072, "uuid": "5af6070a-1c6f-42bf-88d3-7d5c053b5e2c", "value": "T1ABD2D0E3613E617DF43501B62AA6DAC4F9336863294A4B6F05C4F2E9BEFFC642604D50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747072, "uuid": "713063ea-73a8-428d-befa-c001b84cfb90", "value": "768:EQhXes5cu6cJtGemS8AX7AWHGGcdnZDaBg5J+x0Ja:bhXeXafmS8ish5ZDaBgima", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689747072, "uuid": "7cb753dd-2b32-41be-94df-09a75e3c1e7c", "value": 29740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689747072, "uuid": "71c55a70-3611-4b5a-a5e4-0d1999256181", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747072, "uuid": "4a764d4b-7496-4f76-bdaf-6d39c10a67f1", "value": "sora.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c733a0f-25d3-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689730048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689730048, "uuid": "32c06252-29f1-4532-bb48-a1cb7ba8171c", "comment": "Malware payload", "value": "0a46cd2f0b720bf9a1061b7b19656062", "object_relation": "md5", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689730048, "uuid": "85830d71-5b78-46db-9e55-6be0d4823095", "comment": "Malware payload", "value": "8ab7fc39b705f8784266ac5f16b0167c75721c88a847a15d6195566656b28e79", "object_relation": "sha256", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689730048, "uuid": "6ac545a2-56f4-4706-a1b1-26d5db899434", "comment": "Malware payload", "value": "ea6093b39647e3915d26e4aaddf628a93d6a938c", "object_relation": "sha1", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689730048, "uuid": "c2d28e83-6f91-484a-827a-518712a0365d", "comment": "Malware payload", "value": "7b85abdd430d010c92c6cd12656f43d6dcac27119c88193959d01a6b52f6193e46097873208081559cca0f6fda66a5f4", "object_relation": "sha3-384", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689730048, "uuid": "19deb534-4a29-485d-9ccc-115750e4bf04", "value": "T16243A23CA321C44DA9736A3BFCE42F655109AF97EDC9B7C9041880973EF067A71146EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689730048, "uuid": "a05ad2e9-cdd8-4082-959a-99f0b3073c6f", "value": "384:ULMWxhyvUvO+nNxGjVNN0kfGgy9/DEAtsOa5OLJCr1WOLuPlROH0a9LVoLyFSHr7:USvKEXSkOWU+iVFF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689730048, "uuid": "43d5bee0-77ad-4368-8b2b-c80f0ee38a64", "value": 58733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689730048, "uuid": "49a50904-5d03-49ac-b85d-e566383a2d03", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689730048, "uuid": "039100d0-7c9f-44e9-a9ca-7c7d7e4101d0", "value": "SecuriteInfo.com.HTML.PhishingMS-AOQ.31135.15239", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3bbd813-2602-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689750381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689750381, "uuid": "47443347-bdd7-40bb-ace2-a1f5c6bb3134", "comment": "Malware payload", "value": "b28fc3ae74e3bd561fe71458f1e4c538", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ticanews-com", "colour": "#FB8398", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689750381, "uuid": "84733ff8-7f0d-45f9-8fe2-39926604079b", "comment": "Malware payload", "value": "8b51824d968a95c4d6212265b0702a98785e97013a3cb543aacc9c3dd304ab6b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ticanews-com", "colour": "#FB8398", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689750381, "uuid": "05dbb2d2-8a82-4087-8443-36d358185a35", "comment": "Malware payload", "value": "ce85bacde140a6b9891b2bcf37084ae978e8d29d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ticanews-com", "colour": "#FB8398", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689750381, "uuid": "6540962c-95ca-4696-b1e4-34bb76c2e870", "comment": "Malware payload", "value": "d0ada58e3f56fb154e07d6a49c4c6d3cb3e5b3d561c460bff4442b9b01710fab76f167dbbc3b740f12a53013831664ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ticanews-com", "colour": "#FB8398", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689750381, "uuid": "3e60b445-f627-4152-bd5e-6a1b742ea906", "value": "T1BF22402579EA127AE5B39FB23ED135C5DDAEF3336855295F208503074D02B80DE92A3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689750381, "uuid": "365efb5e-1df2-4fff-acbe-6c36cd32d467", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689750381, "uuid": "7b852d7d-9fbb-44e3-b6dd-1d8679d27af3", "value": "192:aIisU7axrd6Xaa+9FPWmDfUBFYWdbkV+GHOvzs:a/sA5Z+PnDfQFYWdwg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689750381, "uuid": "a24df396-99fb-47b8-8ef4-27279dec8bff", "value": 10752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689750381, "uuid": "c674945e-e004-49fd-baa4-a057c1e60700", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689750381, "uuid": "26b7f6c2-4a18-480b-8534-db077f893e31", "value": "MicrosoftUpdater1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73f8fdf9-262b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1689767856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689767856, "uuid": "62a66b21-b012-4c22-a27d-c9fa9a4ddbcd", "comment": "Malware payload (Loki)", "value": "c2d9aa3d55bba16f00b60c10ce6625a8", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689767856, "uuid": "d24fa368-b11b-4737-a377-1bd99e441d40", "comment": "Malware payload (Loki)", "value": "8b74a1c7e6ff386058cf13d25d35abfcb34f0f0688337f5c07958257f9cbe96a", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689767856, "uuid": "e0c71d70-364a-4b83-ab6f-9d2952ea8bb7", "comment": "Malware payload (Loki)", "value": "adf92d53df8780ab0757ec82d9293fc7361a6144", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689767856, "uuid": "c6cbced8-2d7a-4cc0-add5-193e98149896", "comment": "Malware payload (Loki)", "value": "62d1cf780a2c2179718f6419dec389d9306ba565f4777cc1b9e50641d5c13eb19adc46f7fd2b23107440d9f4620753ca", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689767856, "uuid": "95c2bac3-b0f2-4801-b340-4103a6fc06d7", "value": "T111B423EC877C7227657E4C3414E0EAB626829A54BC4DC3C64EBE8F14D7CC07D5A2526E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689767856, "uuid": "2b33c3a2-83a1-460c-aefa-e45fd1d0477c", "value": "12288:lcU2gxvS2P3i3ua/Hjd+775PtoNAOnKM0YrA5Cv8vnV:lcUXZS2PGboHfoNADYVvgV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689767856, "uuid": "8415d58c-0583-4e2a-bab0-7bc2586314c7", "value": 519549, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689767856, "uuid": "2a605828-2240-4d86-a524-f69ecedd99d2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689767856, "uuid": "e4420627-f294-4755-ab6f-865c41e165b1", "value": "D02397801.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28b2555b-25fb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689747114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747114, "uuid": "a77f962f-0adb-4ca9-ada2-50cecaf9ad9a", "comment": "Malware payload (Mirai)", "value": "aec00724a1a675f39ace1c36740e5ca2", "object_relation": "md5", "Tag": [ { "name": "2-59-255-213", "colour": "#A4F8B9", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747114, "uuid": "42232471-bbc8-4c26-b18f-b9eb89754977", "comment": "Malware payload (Mirai)", "value": "8bda2569b43cd68158d67b4ebc43336d25be25ccd64639a75ccfad3670beca4e", "object_relation": "sha256", "Tag": [ { "name": "2-59-255-213", "colour": "#A4F8B9", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747114, "uuid": "62c1962c-3611-40a3-965c-a16e2b94c669", "comment": "Malware payload (Mirai)", "value": "d9c65ca2e391d95be84af10809bf91325b73047f", "object_relation": "sha1", "Tag": [ { "name": "2-59-255-213", "colour": "#A4F8B9", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747114, "uuid": "04a38c9c-62e0-4d92-bf7f-5210fb6569b1", "comment": "Malware payload (Mirai)", "value": "99896fceefa3702800b808a93fa8990b0003536293275d23d10e280cbcbd454fa5a9fc15383942cad7f0af0589bdaa65", "object_relation": "sha3-384", "Tag": [ { "name": "2-59-255-213", "colour": "#A4F8B9", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747114, "uuid": "81959287-366f-4626-901b-ba943492e4e0", "value": "T15333F174793B89F3DCE71C7BCC270D056C76D7B1A06B659220A15EE0927220A7BB8D83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747114, "uuid": "4db419de-9a25-448c-b854-ff3e10e0b696", "value": "768:DxIKFpuMaxJSF2hRXiHjUOlNznwwByAfC84IY8bo2NQ9q3UELqW/3KsX3j4bo9Df:DxIK7o3RsoOlNzwsaMbbZLJZj4bo9D60", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689747114, "uuid": "6de1b195-ad26-4853-88ab-ecff10c82787", "value": 52856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689747114, "uuid": "a23bf6e0-b36a-4346-9e7b-9d6898dd22bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747114, "uuid": "6feae76f-7678-4019-b980-d1a4795e04c3", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43d58e92-25fb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689747160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747160, "uuid": "7d6310c2-cecf-424e-9226-5ba365f8414b", "comment": "Malware payload (Mirai)", "value": "b28101dd02ca713054888cdd0127bbfe", "object_relation": "md5", "Tag": [ { "name": "2-59-255-213", "colour": "#A4F8B9", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747160, "uuid": "2a454e91-464a-4986-a900-b6485733b2ba", "comment": "Malware payload (Mirai)", "value": "8d238e595c8090d82954ca15f2962d2b63a17df11c165d76eadfd562922f04bf", "object_relation": "sha256", "Tag": [ { "name": "2-59-255-213", "colour": "#A4F8B9", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747160, "uuid": "9b17dcba-4dc3-450a-8e3c-97b391ad7910", "comment": "Malware payload (Mirai)", "value": "547116395d33cf1b765f9dd960980f02a07a6674", "object_relation": "sha1", "Tag": [ { "name": "2-59-255-213", "colour": "#A4F8B9", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747160, "uuid": "a67cce3d-9bcd-43a7-bd94-23ebd2534a2f", "comment": "Malware payload (Mirai)", "value": "b397ffd57a361d0bed51b5a79a52a4e6ca68559acabb58e11161862e3e47472acc9627fb9f41924d841198e156e323a2", "object_relation": "sha3-384", "Tag": [ { "name": "2-59-255-213", "colour": "#A4F8B9", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747160, "uuid": "de9bf367-e055-46d7-88d5-a48eca58c60e", "value": "T1AAD2E0F712138DA4A5B28434C9F9C3C6DB0B66FE71FD70687600424D9E57A81AAEC4B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747160, "uuid": "200065a5-df91-439d-a7d1-23fb0539ad3f", "value": "768:tBfi7DNUo8psTcUFzE1t1N2dVO837s3UozQ:naUsTcUFzE1rAdU83mzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689747160, "uuid": "2a0d4cf3-c2a6-40f6-a058-b46ff1fff6c6", "value": 28548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689747160, "uuid": "089bfea1-b36e-432f-b7f0-5403a9fa4912", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747160, "uuid": "03d08181-d86c-4f68-ab2f-1f8ce66c195f", "value": "sora.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "116712c2-25e1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689735908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689735908, "uuid": "3e3ba291-1837-484f-9537-34fd3da3ba68", "comment": "Malware payload (Amadey)", "value": "64d2fb72d06a5ce665961f873a0abe04", "object_relation": "md5", "Tag": [ { "name": "600MB", "colour": "#73751E", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689735908, "uuid": "4cb7e2f2-d6d4-4442-a97c-9c2014103c47", "comment": "Malware payload (Amadey)", "value": "8d7bf89079867d769c14d3a5edbb3f26b3687630b4569ea46ac18bdc9c9e3ac6", "object_relation": "sha256", "Tag": [ { "name": "600MB", "colour": "#73751E", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689735908, "uuid": "ff883edc-1e38-4aaa-ae2b-9a5ff7d6372f", "comment": "Malware payload (Amadey)", "value": "c169aeb0aa7bb1a9581ed1acb76100b604d8b352", "object_relation": "sha1", "Tag": [ { "name": "600MB", "colour": "#73751E", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689735908, "uuid": "a24bb7f8-229d-45bb-8019-fe1db6e67ce7", "comment": "Malware payload (Amadey)", "value": "360588e7e1b0aa3dd65d01b166edd83499886b3907d617ab90e49e311ea399331a1931654d53c9c0cbe940519543b0b4", "object_relation": "sha3-384", "Tag": [ { "name": "600MB", "colour": "#73751E", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689735908, "uuid": "f1e50578-9758-4e25-b034-42aaefdaa296", "value": "T14E56112AF49637B1F84DC5B405B01CA403E57D36222B47C822B1B56F9627F7E8EB4939", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689735908, "uuid": "5b3e5c5e-da80-4ef0-ab9e-84d1fa358dd7", "value": "98304:rVYuPo0/MX7aaY+wX5kMzpIq+ZMtZjPyFXG8Gimk9eAsLKvvmCTmOM/1Zp:rLPoq4aP+wXqMzqq+4aFXBB9eAxGC8vp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689735908, "uuid": "5d3c3719-c27d-4fbf-948a-ba78825bae35", "value": 6357231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689735908, "uuid": "581f5092-e269-4d5a-82f0-6f9d5ff3fa71", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689735908, "uuid": "133b4065-3d49-4a7c-9cc9-f8e41675523e", "value": "File.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "607d9dbe-2623-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Hydra)", "timestamp": 1689764387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689764387, "uuid": "c284c018-390a-4cf9-aecb-1a3c679cc2e8", "comment": "Malware payload (Hydra)", "value": "eba50ee1a0f282daf68ccd4bbaace360", "object_relation": "md5", "Tag": [ { "name": "android_hydra", "colour": "#626579", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689764387, "uuid": "f0eba088-adc5-4111-b326-88029ce28b9c", "comment": "Malware payload (Hydra)", "value": "8da5afd8c4f77eafbb72df3595f26933f63ccd19d7faeb2cf9ad1dbf9893782a", "object_relation": "sha256", "Tag": [ { "name": "android_hydra", "colour": "#626579", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689764387, "uuid": "1017d0e8-93d8-4951-9554-488153d58709", "comment": "Malware payload (Hydra)", "value": "4c26221855f46abf00c8e6fdef635359ed94f963", "object_relation": "sha1", "Tag": [ { "name": "android_hydra", "colour": "#626579", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689764387, "uuid": "0cc97fd2-863f-4af3-9df8-318c90e98b71", "comment": "Malware payload (Hydra)", "value": "960a05d547b024d1543bb56a7e9e40c2b7461cc6464cd8dcdaeeddd70ad3be0c8bd4a3fca8e0f9cb0a4c8e5ca708c3fa", "object_relation": "sha3-384", "Tag": [ { "name": "android_hydra", "colour": "#626579", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689764387, "uuid": "e8278625-8f53-443f-89f0-6dcec7e5e8e9", "value": "T1A8163380F1E6A107EEEB1379CEBBA5C2046A7E94DB0587433059336E5437DD5CA70AA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689764387, "uuid": "adf5aeb2-8377-4bd8-8fab-890c50349a56", "value": "98304:DRTKgkwmjEjSUodBUDT7B4l8jpxuO29OzJszTO4wK7gTp8oP9:DogkmNEINjpV2IzJy1cTiol", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689764387, "uuid": "7ec470f7-71f4-49db-896a-35c52aabd699", "value": 4047713, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689764387, "uuid": "00113b0c-138e-4173-9eeb-d217d8ba0391", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689764387, "uuid": "5a8a4958-62f8-41a6-9d8e-d92ad8b6e8a1", "value": "Commerzbank_Security.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed09553d-267f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689804137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689804137, "uuid": "505bc7ce-3c8a-4b22-9e77-76a5424c392a", "comment": "Malware payload", "value": "3a20a6145a7a57af149bfd110fdd6300", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689804137, "uuid": "9c38ff67-888a-4965-9bee-0e0345bcafae", "comment": "Malware payload", "value": "8e9e34d70a388ee2721911e266e68ebfcdaf460803fa1baf66f9b6cbf560b2a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689804137, "uuid": "e5434ba4-b993-413c-991f-22c9e00e0776", "comment": "Malware payload", "value": "7626cf05a564a565d17cb85aaf6b93c871c3de91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689804137, "uuid": "e6b2e421-c67d-4eef-99de-bc4fa15670df", "comment": "Malware payload", "value": "a3ed264fcd611e6c7512f16839fd174b6900e10033590f4712b1507653142e0324a7562b2d0f0e0764b1c3ced13668e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689804137, "uuid": "e7ab8ea4-0c4a-4c37-ba66-36a84f5056c6", "value": "T1F3F5AE49B9420D16DE7D23F2C22386087A90D853274EDD9E37D36BCAD70E6E3654E2C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689804137, "uuid": "bd94a668-cd83-413a-8257-7cdcc2077278", "value": "49152:2PtyRSv3AJhGiPWGhUyJ4STSVP1JXrb2XpZofxX3ePG0cid7X9MJM5r:EcRe388iPWGmyJ5GV7n2XjOXeGxihrr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689804137, "uuid": "353c2a4a-4ce3-4aff-82d7-313221038745", "value": 3406488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689804137, "uuid": "064c97d5-12e4-48a5-8331-7a9741ecf55f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689804137, "uuid": "a7e05987-9114-4d21-b7eb-00e93135d2c8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e87fa55a-2663-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689792103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689792103, "uuid": "26049032-5cfa-4067-b6e7-686fdb4f4100", "comment": "Malware payload (RedLineStealer)", "value": "74ccb2e5d62e2030711025023abebb1c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689792103, "uuid": "dc73fefa-e0d5-414a-92f8-0653044ed0f5", "comment": "Malware payload (RedLineStealer)", "value": "8f39c7257d62b3b16c5418287177b47ba3de6f34937ace8f4b33ce0d5d7b77ab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689792103, "uuid": "2981168c-db49-4cac-9313-ab3dad77076b", "comment": "Malware payload (RedLineStealer)", "value": "8f64153bbbb8068906ea3a242bc5fd6904787943", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689792103, "uuid": "d45a217e-dab7-49ba-b765-8a15e132db2b", "comment": "Malware payload (RedLineStealer)", "value": "cd367f1a235381aab880ec1c0d84a6b19a94609af891e634c87ba4cd1049bb28ff5c32edf211c32e396619b7b7dbe65f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689792103, "uuid": "c573619a-5fd4-4009-8d13-9aa5319663cf", "value": "T1CF74E09237E0C032D1776A301971D66129BBBCB16BA551CB33883A2F1EB17D01B7AB57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689792103, "uuid": "d01147e0-86ee-4ffe-b4c5-5b7a8da49cc6", "value": "b64d2f93bd8f1bc9d27e80e5b6c25b2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689792103, "uuid": "8b445cb3-f348-4b0a-98cf-a72b41c888ff", "value": "6144:FhMQUR5BQJifadP8vILwhE4jwNeR2wCtzDegMqVe:7URnyifVILwhEXQLgf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689792103, "uuid": "f4248d16-0d42-4a79-8b9e-a6e5e58283cc", "value": 353792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689792103, "uuid": "973bedc1-256d-49ce-b7f2-91c07fb869f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689792103, "uuid": "299d5d98-cd2b-491d-bc19-2f527c0fe274", "value": "74ccb2e5d62e2030711025023abebb1c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d44821f-2671-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689797856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689797856, "uuid": "2bdae6f1-cc15-47c6-aa86-732a934430b3", "comment": "Malware payload (Mirai)", "value": "27a9cb54836e5d5a4c53f8d895c8f0a2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689797856, "uuid": "d009f8ae-0147-4ecd-a045-bb371a2cd78d", "comment": "Malware payload (Mirai)", "value": "9046d43e75d709d6a42407e5eb8998088269bc7c5a6ac4b506602a14e77f87fb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689797856, "uuid": "f55082b5-c46b-49e0-bab3-8cc6c0e1ff10", "comment": "Malware payload (Mirai)", "value": "65c8451a4442493d8dfcd8dee3dd63d29cfce757", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689797856, "uuid": "3e4717db-9936-4995-a953-00bf0ef23696", "comment": "Malware payload (Mirai)", "value": "2e03521956d5fe6ba66d720cf1f4655f8968e15025d80368e3cf6c29330fbfaff53787b13783ecfbb0823f6ef2e52299", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689797856, "uuid": "74664bc8-f946-4793-b1ef-67f290d97df9", "value": "T1D5D2E152FD530992FBBFE9A02A24D9C07F6B8EEE1FB4DCD630D96B512549A124D00DC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689797856, "uuid": "42e0337d-3b50-4540-9d1d-e46bc16908a2", "value": "768:QRtVr1QC5J4H2TO1/kcDNotffW31hdhbThb91/iz+4uVcqgw09j:Q11QweWfWwf+315TV/iz+4u+qgw09j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689797856, "uuid": "159d9ce7-740c-4afc-b601-bfe2dc3543bf", "value": 28328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689797856, "uuid": "c8f66cd5-24b9-4164-bcf4-88a335b7795a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689797856, "uuid": "47fc5d56-9dd2-442d-8fdb-389591fbd07b", "value": "27a9cb54836e5d5a4c53f8d895c8f0a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a9a4263-2659-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689787544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787544, "uuid": "e12db866-7892-4957-b62d-cf2616095cbc", "comment": "Malware payload (RedLineStealer)", "value": "19dd58a04c7ad928f3eb0fae77735a60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787544, "uuid": "111c4ace-11e3-4e47-8bba-45c94368f7de", "comment": "Malware payload (RedLineStealer)", "value": "9051179ae14bd7accb3d6ee7f17f9f921face0e4831e451d984182eab7fe5709", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787544, "uuid": "e784c762-0b62-4f1c-ba4f-7534357c60d3", "comment": "Malware payload (RedLineStealer)", "value": "16d6d8eba5e622e51224c7d64e005f3773530af9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787544, "uuid": "ea65019f-0769-42ee-a571-6d27ec3671d4", "comment": "Malware payload (RedLineStealer)", "value": "20fd6be1c246e6e81f77a4af9b7993eb9814de74c6c7eabce6ae6a4c5a4f2332dc54d8ab968e0155f83eedea6c556b02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787544, "uuid": "728d5090-0913-46f7-a77b-1b624d4c9f42", "value": "T12E840103E6E98072ECF62B7058F703D32A34BDE15D78536B2345989E4CB2984A53677B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787544, "uuid": "f24806a7-bbc9-4112-82f2-6fc2073bb428", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787544, "uuid": "9001e9fb-16c9-442f-acc3-6e70d0eb6cf1", "value": "6144:KUy+bnr+xp0yN90QEYLRtg2LY/U8rvZEpVi77YoNt3junyJ7zF17wCHIeYC:EMrdy90OLkV/XvZJvYoN9x17wS/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689787544, "uuid": "9bd7cf9e-df0c-4ae8-b445-5ce15b960438", "value": 398336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689787544, "uuid": "e719bbdd-bc8f-4ba2-a97f-f577ef772119", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787544, "uuid": "a70991e8-4fce-4b53-bf28-8f33520087cd", "value": "19dd58a04c7ad928f3eb0fae77735a60.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9611fe74-2679-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689801414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689801414, "uuid": "d9f4b386-1261-46aa-8220-2289345cccd8", "comment": "Malware payload", "value": "5aebb5642fd82cb62b79041200cb20fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689801414, "uuid": "4a9eeff0-be77-4f50-bc82-fbacaf5755d6", "comment": "Malware payload", "value": "90caa22dfb96b704dc1e122d2cfe1930311b24814537fe59b11ba156a48bfbc0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689801414, "uuid": "32ac04bb-f37b-480a-8b21-210ba55c5ec8", "comment": "Malware payload", "value": "241469bb753d3642d459a93a2a86d9a7b08877bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689801414, "uuid": "38f97974-4a3b-44d1-bc6c-80beab34eb07", "comment": "Malware payload", "value": "672dcffe1a83c47856ad77efd739c2436e87db7d7ca1553bf137faf08d51ca706a74a87985dc108e5ecace69304f644e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689801414, "uuid": "a6a07ab4-a1c4-44d4-9239-bda13838dcd2", "value": "T1C7853352E78EA2B9E1F599B47976950B1273B8242C360C2D3BCF9A4C1F334A34987771", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689801414, "uuid": "8d6b40ef-a473-4383-94f3-17a79cd1148e", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689801414, "uuid": "cdeea350-add3-40ba-9b1c-8c864c316650", "value": "49152:P2YLzycqm2rrYaipqfc9cgh+L8+i/PfVMHc7B6:OMgOpMfL8n/uc7B6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689801414, "uuid": "9b396105-d70f-4405-bcff-d393dc9730ca", "value": 1720746, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689801414, "uuid": "d5b8b2b7-e2b4-434b-91aa-ec5b90320651", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689801414, "uuid": "24b483d8-8136-48db-9ec2-626c8ea7e87d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9f9703d-2620-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689763222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689763222, "uuid": "823e4777-9156-4a09-abcc-9d7af86551bd", "comment": "Malware payload (RedLineStealer)", "value": "fb0e16c10374b26f42999ff5abe3a531", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689763222, "uuid": "84bd59ce-0e88-4331-9954-9a3628f135c6", "comment": "Malware payload (RedLineStealer)", "value": "91b80875c26eeb0f4169bdcb3c9801455231b38d70b761aa81fa12d74f83ad0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689763222, "uuid": "2dfa8385-f7bd-4991-828c-d050d0a9a19d", "comment": "Malware payload (RedLineStealer)", "value": "24ded5fa2d9a2e4b2a21273dd1a5c77d7c10f36b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689763222, "uuid": "ac912e4b-5429-4bc3-b03d-f2c2c5dee2e0", "comment": "Malware payload (RedLineStealer)", "value": "d6885f833b087f4c0b6521c5d1dfc73cb77796912cc317e24fb73c2ffb8400ce8bb4c29e26b8f9dbebd02e5685ca2d7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689763222, "uuid": "6a316138-8539-481e-8c14-88f51673c81a", "value": "T187840253F7E8C032D8BA5BB098F603D306357CA19A78826736C56D4A1DB36C0A93577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689763222, "uuid": "2ebfa5b2-606f-44c0-8d70-ddd87afa4a4c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689763222, "uuid": "41dc8bc5-5182-4b33-8faf-63162e834248", "value": "6144:Kly+bnr+ep0yN90QEIWk/QrnGlg7PL/ZSBWEh9AIF1hSUy8qy:rMrOy902WjzGq7LzKSENy8qy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689763222, "uuid": "03287c49-9e2f-48e3-b0a2-05aba9f85b67", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689763222, "uuid": "3b5aa4bc-1f96-47fc-88de-4a3883b36191", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689763222, "uuid": "b75f9e65-20f1-4550-ae03-bc5c317766cf", "value": "91b80875c26eeb0f4169bdcb3c9801455231b38d70b76.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "691b681a-25ed-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Fabookie)", "timestamp": 1689741209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689741209, "uuid": "67cfaac7-a790-42b4-aa22-2cb2f5ba5968", "comment": "Malware payload (Fabookie)", "value": "c8d4c02e3d2695daec4e46ae5bd60924", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689741209, "uuid": "5f03d57a-c942-41a9-8517-2493daae2e83", "comment": "Malware payload (Fabookie)", "value": "921be1b8d816c2be89215fabed8b804e7befceceb9094c0c8ab8f38b70bdcf2f", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689741209, "uuid": "7aca9b13-f34d-4d4b-94f9-d5ea76665cb3", "comment": "Malware payload (Fabookie)", "value": "3d9166be777f9b1ff782c24f919cbc7e8a9bcdd5", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689741209, "uuid": "7f66646c-f236-4b88-8791-8453a82f2cf1", "comment": "Malware payload (Fabookie)", "value": "2c1223efe77144d6bf763a17e676e08aecbe3c90fd0c20bbf5f7fc379dda6821b112cb1082a9faaa366203ffc24bfe0e", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689741209, "uuid": "4eb25b2c-bc7b-4ae5-8f4f-752769f555b6", "value": "T14DD4CF81B39095D9C4B88430C693CE71CA317C64DB28569BB6D4BB6F2F32AF1653731A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689741209, "uuid": "41e7b305-6b39-4d3a-a984-b775e1215261", "value": "4673ad56625d375f2efee239af061364", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689741209, "uuid": "e04a7b1a-dd4c-4725-9315-e6914fa8407f", "value": "12288:y72LPfVjvyD8XM3lRkRc4YFwjsWAfRgantPbcTTn7axerx7:eafVr6WM3/kRc4lAgantPbcHn7a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689741209, "uuid": "dcc6e0f1-a956-414b-ae12-d1a4f9f258e2", "value": 605184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689741209, "uuid": "42b1bc6b-f4c7-4428-8006-5fdf9785a0c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689741209, "uuid": "6cf211cd-dda9-49eb-ab56-0ed633466636", "value": "c8d4c02e3d2695daec4e46ae5bd60924", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16916be2-2647-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1689779725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689779725, "uuid": "f165254b-c77b-4574-9b22-3d4c0f22a3fc", "comment": "Malware payload (GuLoader)", "value": "de7cd552b649caa3fd4a893099c8a924", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689779725, "uuid": "31d9261a-13b8-4ffb-b5da-c36f28cade98", "comment": "Malware payload (GuLoader)", "value": "92e55159b6e18fb75e5aa6d39a9b37822619c9d31123894ade0f7c4544a045cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689779725, "uuid": "76159527-78e8-4982-9cb3-77e7a2d6cc30", "comment": "Malware payload (GuLoader)", "value": "d99f51698077961cf1d46a651dfa14ef18d19e13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689779725, "uuid": "25cc8cc1-39be-4230-87ba-e166f920c8bc", "comment": "Malware payload (GuLoader)", "value": "b92aa45248deb47919272d367e87484794a973321303c993ae54393df47d432023b8424fb06d1032e09e7ac85f7e82bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689779725, "uuid": "02265361-02f3-4e47-8cec-a08d4594ffef", "value": "T12A74129AA6259037EDB2C370D63EFE37CFB94348A9D02F432364994239571864B2D687", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689779725, "uuid": "4f93c70b-3f66-46f9-a8ef-2f3d67039a79", "value": "b78ecf47c0a3e24a6f4af114e2d1f5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689779725, "uuid": "f66b4a6b-edb3-4948-841b-22cb534a489e", "value": "6144:xpW706rxuUnXSMGWZz5teVqf787zFg609T0IHj5euOWK8U3QvO5iduiM:KI6r3nCTWJVj8Rg6qT0cNNOWb25EuT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689779725, "uuid": "77836871-b345-418b-8ae8-bcda792e0c66", "value": 360920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689779725, "uuid": "ff7cffd3-d580-4483-998c-4b08f9b08bca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689779725, "uuid": "db439060-18e1-48a3-b7f7-c2fa2f588872", "value": "a.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db31260a-2624-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689765023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689765023, "uuid": "e0c3bba4-a977-43b2-abc9-56c5c702af90", "comment": "Malware payload (Amadey)", "value": "44a848e4b9520f9d584cf99c85596f31", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689765023, "uuid": "1e18a3b0-5b0a-4e36-8cfa-c2f0b914819b", "comment": "Malware payload (Amadey)", "value": "936ba228baa5f98042f45615713758be340244279bf8c8d4c920df250c079f34", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689765023, "uuid": "5c57cbb6-5e2d-49ca-958a-be500807a11f", "comment": "Malware payload (Amadey)", "value": "3cb7149a32de8a5b1990772d4660fb2a55ac8819", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689765023, "uuid": "417dfaa0-8d52-4f15-bfcd-60f637091186", "comment": "Malware payload (Amadey)", "value": "5b1d43d59c0111e79d29c223cd5976c51c1bdc7fd6eb15e5e4c2201f1c2c793b56d277ade1ce66e580e554c493cb39be", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689765023, "uuid": "81d27276-317d-4fa4-90a3-d1c3578ffb76", "value": "T19584011696D88073D9B51BB059FA13830B3ABCE25D7883AB379698090D735C4FA3177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689765023, "uuid": "eefd725a-b269-45d7-8e5c-913cb83d9351", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689765023, "uuid": "4aa59c07-ee23-4e91-a94c-542d272ef364", "value": "12288:kMr2y90ij0+/R44++ZjZ3XSkcHnl9SYTUqxa:Ky8eO4XXSrHcqxa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689765023, "uuid": "a7526b17-b905-42d8-bc65-20546aab490b", "value": 399872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689765023, "uuid": "2893a0bd-30c7-471e-b479-c66ef03da6fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689765023, "uuid": "23afce02-3f08-4718-af9d-0fdbcbd2135f", "value": "44a848e4b9520f9d584cf99c85596f31.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7cab3b7-260e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1689755622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689755622, "uuid": "4ea51b84-9357-4729-9f7c-3c4cd4e92128", "comment": "Malware payload (GuLoader)", "value": "cd5467f530084c8e404c9de98b17d83d", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689755622, "uuid": "1f179118-60c8-43c0-8933-451105b6bbba", "comment": "Malware payload (GuLoader)", "value": "9402f92344f097fe3ab1e9904b004bf9899476eaef9f85f267e7654670d726a2", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689755622, "uuid": "4eaf77e5-776d-4c48-a864-48fa1241c180", "comment": "Malware payload (GuLoader)", "value": "fc2084b7864aabe8738497291c49a1f3ff5f1e94", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689755622, "uuid": "e8c52d00-18be-477c-9513-34887a540eb1", "comment": "Malware payload (GuLoader)", "value": "56f6bed89dd158a07761df51fdd9a4c54a5bbf0223105d41a36934ab079ee54f52de7c0e93d1f896ab265aa8f3380275", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689755622, "uuid": "9baa9aeb-73e6-4576-99f1-206111fc955c", "value": "T10664236BE3DE8573A799E22509010AFBB4C51EE2402967161031E7EB9CC177CBF9187E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689755622, "uuid": "54b5bfd4-8bdf-4805-8cb5-5f471e80397f", "value": "6144:VB3zxGbZCdqNoB1iDgQcYjWL81OF84B/Zwt/H3MQe3UfQ9JQbvH5PaSC/+Zg3:VB3zxGbZCuo/6ggjZOF84B/Zc3MQe3em", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689755622, "uuid": "4373f0fe-1f98-458c-b588-cc3ec257dc6e", "value": 334492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689755622, "uuid": "5e48c2ef-4f60-4c35-9dba-01f115a4c7b1", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689755622, "uuid": "2db56bdc-57e6-4028-b50a-9fa1372e5b7f", "value": "CDE_8406727184_pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d3c4e2a-25fb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689747148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747148, "uuid": "b63a9ee9-0e41-46ef-b4ca-63a4f45799a9", "comment": "Malware payload (Mirai)", "value": "94a511587b8f70b94598cf673a04b149", "object_relation": "md5", "Tag": [ { "name": "2-59-255-213", "colour": "#A4F8B9", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747148, "uuid": "556a5dba-24d6-4f8f-93d5-ecfd71ba12b5", "comment": "Malware payload (Mirai)", "value": "940cf100eca437d27a3ba6299f8e3d4797f7f09089bf3c6eb6aa3b89a5834617", "object_relation": "sha256", "Tag": [ { "name": "2-59-255-213", "colour": "#A4F8B9", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747148, "uuid": "9835c870-623f-4016-b75c-d10c1060ff11", "comment": "Malware payload (Mirai)", "value": "3304ed344adb75640fd10f66b0af61f19852b2dd", "object_relation": "sha1", "Tag": [ { "name": "2-59-255-213", "colour": "#A4F8B9", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747148, "uuid": "b98410ea-6a40-452d-b607-29a24cd95bbc", "comment": "Malware payload (Mirai)", "value": "b2cb3c40a3a90184e4ba38a47b45bb4f3f1676399f8cc6c55f075924126af9f56a2aa896e14ec61bf6acfbb5c38c5f86", "object_relation": "sha3-384", "Tag": [ { "name": "2-59-255-213", "colour": "#A4F8B9", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747148, "uuid": "6d2ffb7d-2cc9-4a22-8ac6-44bb4146a2f4", "value": "T137E2F2EBC5755121C855487AA4699ACB1CA76EF8805E3079D8628DCCFB02CC2E5FFC87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747148, "uuid": "0cbbe35d-717b-44bd-8153-25c6e08b4e23", "value": "768:zyhBNFpFXMxjyf5FZu0w7Zr0vqE9KY9q3UEL5M:WhvF/XMJQ5vXw7tKGLC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689747148, "uuid": "4ef6e2d8-4e58-4cb5-a27b-9cd16e842842", "value": 33388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689747148, "uuid": "fd39d2d8-b54b-4b55-bf02-d540448c4ade", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747148, "uuid": "bf799b2d-61a9-4d2c-abae-b2e8b3c1a454", "value": "sora.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e74bcfe7-2659-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1689787806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787806, "uuid": "a2732135-5f85-4e4b-9b91-a608b503ab6f", "comment": "Malware payload (Formbook)", "value": "aa37e3d1280bf2cdfc58a60405290168", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787806, "uuid": "73a8e5da-befd-4261-ba05-cff30c276ecf", "comment": "Malware payload (Formbook)", "value": "94d341534d0916d587060a3acd06eed3928d09559c0a7ce69017f9037c5c859e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787806, "uuid": "36d2b135-b448-4346-82e9-36c05ecb76ea", "comment": "Malware payload (Formbook)", "value": "4c61b75de60b14cc7ffb3cc42116e348adc38ea6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787806, "uuid": "caf96292-8c0d-497e-a43d-6452352de3ac", "comment": "Malware payload (Formbook)", "value": "0c526888a5ec0507071cea9759dbc89e1922c9d566111652183c934280017f3f8057fa88d5018a0289524041a70de650", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787806, "uuid": "89982052-3a43-4433-bca6-fafd6f8d8c54", "value": "T10AE4121032A48B23C65587FA0654974563BAAFEC2491E11ADFEFFCE672B6F001E84D17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787806, "uuid": "d774a8e1-2d6b-460b-a4a2-9cc849a9235d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787806, "uuid": "16999c47-c4b6-4262-bb37-8778ebd24ab6", "value": "12288:n9PYPfY7FmFHvKwZqjiVRNg+c7MrU+Qo+NISwT48QtJQ0WVEoRSKlZ9:9PYPgRmKT+aMrU+Qo+drtloTRSKl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689787806, "uuid": "56b63aca-662b-4ea6-a75a-4afb410088dc", "value": 665088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689787806, "uuid": "76638ec8-3aea-4f4a-be36-50b58bc76c4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787806, "uuid": "f0377fd7-c83c-488b-9359-1779b3be44d0", "value": "SecuriteInfo.com.Trojan.PWS.Siggen3.31791.13244.31686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dd0ef1e-2609-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RecordBreaker)", "timestamp": 1689753216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689753216, "uuid": "a982266b-d101-4cb3-8d29-3a25939ef921", "comment": "Malware payload (RecordBreaker)", "value": "2d3b0999d98732935a843d48001b33b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689753216, "uuid": "5b8e7a0a-82ed-48d8-b224-8d539dbabfa5", "comment": "Malware payload (RecordBreaker)", "value": "9571a8826bbbc44202e717af7cfc4a66b896e3e44cbbbbd7ebac5db410be8d83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689753216, "uuid": "17b1bb94-9c7f-4b42-bec0-a7bda2153c72", "comment": "Malware payload (RecordBreaker)", "value": "747cdb17079821bef33c5cecf0311acf95d4d8e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689753216, "uuid": "f03ab240-34af-4d58-b1b1-6b24ee3279e3", "comment": "Malware payload (RecordBreaker)", "value": "808db68bc30757adc094e9efc8d6d49ef28666458163f1460a1760c12844f32143ce5f673996acf98e37f244cafd6fa9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689753216, "uuid": "ed1373e2-8589-4bf8-a556-2988e35f8f3e", "value": "T174D5F13BF268A13ED46A1A3205B39360997BBA61781A8C1F07FC344DCF765701E3B656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689753216, "uuid": "9fa1f256-f21c-45f4-904e-5f35a4f4cb43", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689753216, "uuid": "0e184888-2fdc-4aa5-8922-9b96cc7af698", "value": "49152:0BuZrEUMhPqX5pyw5LsiyRCAhqMpZNwXMYi/LYCEZeXjo6ysi0jiD:KkLMhPW5Aw1kCAIMTKMzbEsXjo6B0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689753216, "uuid": "6d832a1d-deab-45a2-89cc-aaac80d1df5a", "value": 2883104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689753216, "uuid": "32ab3e53-f0e5-48fb-9749-d1c1ae11bb73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689753216, "uuid": "fd4e8d53-3ba0-4007-9b9f-3a55f08b8646", "value": "Set-up.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dfdbfd6-2618-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1689759578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689759578, "uuid": "2ad676d2-e562-43d0-95ff-02840ca71253", "comment": "Malware payload (Loki)", "value": "103264e1af3afccc182abbb66ff64bb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689759578, "uuid": "ab9b16f5-8776-4e57-8897-2e979891b7e4", "comment": "Malware payload (Loki)", "value": "95934ccfa95253459a4caa462ebcb4435c27ef7ce1d3a7aa4c8d6ddea9806938", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689759578, "uuid": "ebe2a93c-85c2-4e3a-b8bd-882fe6ae0ff6", "comment": "Malware payload (Loki)", "value": "96765da528bc4bc406894dc020adafd080e04af0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689759578, "uuid": "a7b20e4d-14ba-4cd5-a2e2-5e68e5e67d64", "comment": "Malware payload (Loki)", "value": "0c435a5e19341465ccd9778c2d1c32d61456d0ce4ade77cc8d041dbfb3daaa83875d58910cc3f7345cdfae0683b288bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689759578, "uuid": "b46943b7-cc3c-497f-abd1-ae960d2ca746", "value": "T1F2C40284B3D9D61AC0EE17BD2730970093F49F566526E60E9FC3ADD6386B7104A60F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689759578, "uuid": "4cd93add-461d-484f-a2c1-36c2d16a027c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689759578, "uuid": "40298b50-cf36-498e-a9f9-d5ababfe9f1f", "value": "12288:tPYPfY7fpf88MbfL5wiE4UYLXb57GdWacRmg8D4jd:tPYPglfabz5wiMkGEpx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689759578, "uuid": "cdabf792-3c0a-40b8-a646-32003ebeff5b", "value": 572928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689759578, "uuid": "e968056a-8df5-4559-a981-77d6e6b5969c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689759578, "uuid": "b1483672-dd72-4f49-8374-b6de25f44afd", "value": "PI-EP 05919.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3aaa45a-2635-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689772258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689772258, "uuid": "0c5c985f-4c3c-4e22-81da-1ff2b627827d", "comment": "Malware payload (RedLineStealer)", "value": "0942169ec2e65609b4289811c232928b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689772258, "uuid": "542b1755-cd1f-471e-b73e-0116c0b263a6", "comment": "Malware payload (RedLineStealer)", "value": "9631e649332c76995b0e687fcd99281c9cdc87508bd5d0ec7aa43c2a454f4d29", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689772258, "uuid": "07203132-9029-4492-8009-a828030b9d68", "comment": "Malware payload (RedLineStealer)", "value": "84b2ab06cb8f9406627631f45c72aeee2aee7438", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689772258, "uuid": "fbd8ccac-1373-43d7-8299-41037385d670", "comment": "Malware payload (RedLineStealer)", "value": "cbfcfe6480569428c6a077b62af81c8dc4db02bbe6d6ddce725410d0e04a9ff66a5a461007746d4820c79e3a7c5ca336", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689772258, "uuid": "e784a41c-508e-4b4b-beaf-4c60698b79a6", "value": "T1B1F55AE1B640F000F7569D37B08A0991D9613CE3BB62FDF67E57B7682738AE40648693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689772258, "uuid": "8bb30e99-faa9-4e49-b12e-739824e71353", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689772258, "uuid": "85f38cc0-59f3-4436-a0df-51fab6af33f5", "value": "98304:c2RZ75ZrpcMkrpPRc7r6yJYSzZOhR69lg:c2LvrmM+O3hJYSlD9q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689772258, "uuid": "d99cfc04-0fd7-406e-9ef4-58df79942c29", "value": 3333312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689772258, "uuid": "4f109069-519f-492c-b297-f31e5ab16d01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689772258, "uuid": "123093fc-b214-4bc5-8dcc-986f659fd09d", "value": "0942169ec2e65609b4289811c232928b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b23bf85-25cb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GCleaner)", "timestamp": 1689726475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689726475, "uuid": "729c2edc-2001-49ff-863e-0240878ba7bc", "comment": "Malware payload (GCleaner)", "value": "321907a63f3b5c2273481e4a8649263d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689726475, "uuid": "34a3b919-726f-46d7-8da1-fba268026180", "comment": "Malware payload (GCleaner)", "value": "96eae9eb55a424ead3d62661da9377020452311156a0deba651af397f96f0bde", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689726475, "uuid": "11349ab8-facf-476a-874c-4b6a97515db1", "comment": "Malware payload (GCleaner)", "value": "3cae82e1a225d0e7f4699be9cf0332d61e882ecc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689726475, "uuid": "7562d433-ed47-43ee-9aae-3ac91e6b305e", "comment": "Malware payload (GCleaner)", "value": "5039edec3f9b32db0d48d58772fc7a2069dd675eb69ef3a44d3861c4af4f095891c1e0ee2e83c3f37617b1589d2633f8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689726475, "uuid": "06d75009-44ab-44f0-9939-57a03658ce16", "value": "T18484194392E13D54E9258B729F2FC7EC770DF2508E8A37696129AA1F04B12F2E1B3715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689726475, "uuid": "4a0ddf21-7182-4a01-bc8a-31f729bee081", "value": "41b4eb7c12331a5ff00a984ecb434d03", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689726475, "uuid": "23311bd4-89f5-4c27-97bf-12d4814a3d68", "value": "6144:+zlkLKrvYmVCa4m6iJHL4OQCrVpDeLLkS5JbYRy6W5Rwy:+qWzua45YHLbVpD+kS5VY7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689726475, "uuid": "2d124c25-64d5-499c-a6c5-5a9432673e3a", "value": 376832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689726475, "uuid": "27f63d21-0141-4128-9b9b-c12a6a357ede", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689726475, "uuid": "b0ad0862-16de-4ca1-b15f-d93e68d79659", "value": "321907a63f3b5c2273481e4a8649263d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "363a2588-2632-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1689770759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689770759, "uuid": "8ad46a92-1d0f-4c21-b224-b02ee19aa9b2", "comment": "Malware payload (SnakeKeylogger)", "value": "748ec8e8b465e07469d5fd92a2ae365f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689770759, "uuid": "98d9c718-5f27-4c73-b459-61eae56e54b3", "comment": "Malware payload (SnakeKeylogger)", "value": "96f6d5e92907e880383195044e0481a9afbfa675123f86dc25b643b42c22ba29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689770759, "uuid": "333dc46a-dde5-4f5e-9a1a-2046d3a22192", "comment": "Malware payload (SnakeKeylogger)", "value": "0680fc0f9ccc8d15990c415ddb876b909bda49fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689770759, "uuid": "9df17605-f34b-4ee3-89ba-a42c365acace", "comment": "Malware payload (SnakeKeylogger)", "value": "2522eea109214d48eea247b901d8a795a92c4fde208fccff84058c1170e128fadb3f009e8fb1a2e20dd2b31ee6db75ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689770759, "uuid": "77f5a3bd-bff1-4de7-9aca-e8f61d92f6dd", "value": "T1FAD4014528B88B17C2A4CBF95324630453FA8FD92560F52E9FFBECDB71A9B100980D67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689770759, "uuid": "df6d6a1e-1610-4d3c-a40c-94fd2bbb6525", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689770759, "uuid": "ad63e885-8837-40c7-a8e8-44f7514f4bb2", "value": "12288:NSPYPfY713dxbzSlgpMAn0v4bk5ZgWDoTgeBPYo2XRtNs3ZY7:EPYPgR3dTpZXwgtTJJYooFs3Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689770759, "uuid": "78222be9-4fdc-4de3-91c2-9b43bff30517", "value": 604160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689770759, "uuid": "c6388525-0d74-4c8e-8118-4d8a787e2b14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689770759, "uuid": "9d969dc6-5ac2-4871-a44a-88bb24ea839e", "value": "confirm order.pdf.z.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79f0ecdf-25e5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1689737801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689737801, "uuid": "b42f278d-e030-46f2-bc05-7deb84a3486a", "comment": "Malware payload (Rhadamanthys)", "value": "bad32fa44e8c0aac24af7194ef9cf8b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689737801, "uuid": "f4db87d6-38ea-4b15-8a65-5bbd09f9c3b1", "comment": "Malware payload (Rhadamanthys)", "value": "988076bd6d29e4027272a15de5c11337648d458b3384554328ed317f55dec1aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689737801, "uuid": "9fe34564-8b03-46ff-98d8-5dda8e481de4", "comment": "Malware payload (Rhadamanthys)", "value": "f39f818292e2a71dc644309ada01f8aafcd0b64e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689737801, "uuid": "e23ddec7-d57d-452f-a9c3-e78e65056417", "comment": "Malware payload (Rhadamanthys)", "value": "d09affcbe69c5f11f29a156368b6219f88284f63ae12d722de33a1ae1fceb6cf0a6bc174087e05ae7aa28bb3593134a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689737801, "uuid": "9c9a1281-9724-4318-b1be-e079129ffdf8", "value": "T189F4D5037B9686A2E2595736DDAF4C04C361EDA3722BE70F758E339904433AB9D4960F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689737801, "uuid": "d493bf96-79db-4744-9ab0-899aaa1606ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689737801, "uuid": "218c59e0-acab-4448-87e9-24835c2b2685", "value": "6144:GfISclry0iJCNO7Pi9+g+MeHkxOCUHzRAiSXN2F+VHKLxEwyENwobBqfzI1/8SbK:+IobPI+g+uMCUKiSXxPS2f2wV+gjTx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689737801, "uuid": "ed3958a8-38c8-4035-8f03-585d37f96bc6", "value": 726528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689737801, "uuid": "fdb77cb7-c503-4810-aa1d-debcb03cc02e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689737801, "uuid": "5b08896f-dd16-4ccf-9f92-d22163bc096c", "value": "discussiontelecommunications.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1cb350a-2630-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1689770080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689770080, "uuid": "f5fff07d-b62f-4fdc-843b-c5603adb9ff6", "comment": "Malware payload (Formbook)", "value": "9c2394f874c0283e8749c94aa85ece91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689770080, "uuid": "108154e4-5862-402e-912c-59c805526ee2", "comment": "Malware payload (Formbook)", "value": "9943e60998044146cd134ea065dec2fbad102c3f807844f549c49835339a4320", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689770080, "uuid": "a1b3cbdb-029d-4ee4-9eb7-397382382ef4", "comment": "Malware payload (Formbook)", "value": "2e62f1d0185e4f51bb6074068fd0594a522572e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689770080, "uuid": "f8e55f28-3c7e-440a-8189-6ad615a6fe5d", "comment": "Malware payload (Formbook)", "value": "ceea9569a236fea64997dfd0d1f2d41a8293f79fb74131ebaef9ef9f4d892ee1510360007e8707c7e576d5643648f078", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689770080, "uuid": "de46e1f7-88a0-4870-a7af-bd64fc08513c", "value": "T1AF052E2939AA500DB3729E656BFC75B6C15EF6F226364C7B0DF7020620129F0DB9C53A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689770080, "uuid": "5f01b861-2583-4407-8ec6-188444b55869", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689770080, "uuid": "6e9290c8-c758-4ea2-b2f8-b7ceaa7d0d19", "value": "12288:vRk36u9NkS9cIcBe9vIrEdQriPBr4WsRsuuantwOhyUgW:0OBQ1Br4LBuK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689770080, "uuid": "2978e902-efee-4277-95d9-c69301b0201a", "value": 798784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689770080, "uuid": "d7cee79d-f889-4d7f-a934-560860d7d410", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689770080, "uuid": "94525586-3334-4525-bc2b-a022e4fff501", "value": "PO_8877727726.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "732b555f-2660-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1689790618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689790618, "uuid": "63dc08a5-f37b-45af-b852-8e3150da3bbf", "comment": "Malware payload (Formbook)", "value": "63faba3aff1b5d9cc631bb722bf6c00e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689790618, "uuid": "26b30fad-08d3-4f78-b3c7-4a0eea50ecbf", "comment": "Malware payload (Formbook)", "value": "99748c64e8ad4e2f8877b76cda4e7a8c3ddd4ad8290d18ea6e3dce09ddd92e9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689790618, "uuid": "3c4e20d5-a1c2-4b9d-b58a-6d79d990e55d", "comment": "Malware payload (Formbook)", "value": "1cd7d9fa2ded99c0291e0145a4f35608d33330b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689790618, "uuid": "7965955a-aaf1-4bc1-ae40-3995a698c4d5", "comment": "Malware payload (Formbook)", "value": "715c59eec3af0eeb7d0d41d8948257ed5ead031630590725776ae8b27318e174dd28db2bbad40a4f68a60d363d125f92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689790618, "uuid": "e5e75fbb-6b16-45bd-836b-532c12655844", "value": "T1CEE4225862D88B13C6E427B85360B3A652F55FDE2802EE4CAFD2ECC7F46F7544211A53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689790618, "uuid": "92d956ff-aef7-44ca-a8e6-fa7a76398c1d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689790618, "uuid": "b735cb3f-2305-4964-926e-c7b13785e298", "value": "12288:cPYPfY76LkSLhOt0tfEqWWvdoz+Gbaoe1DZc8evUj+rHri:cPYPg2LkSMO8mviBTOtQUjE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689790618, "uuid": "7acbf2c7-5f85-48d8-8f85-ad808abf5631", "value": 666112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689790618, "uuid": "afc966ea-45ce-4e1f-b46a-95e90456a03f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689790618, "uuid": "7d25ef19-c0e6-455b-a040-2db59879bf14", "value": "file.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b08b51a7-2661-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689791151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689791151, "uuid": "5844dec1-6ee9-4fdd-ba89-349b6d8784c3", "comment": "Malware payload (RedLineStealer)", "value": "01097d203000288cc8ef629b9b830dd2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689791151, "uuid": "fd2ac005-a93c-41fe-922a-6992a2a8f339", "comment": "Malware payload (RedLineStealer)", "value": "99c0cf1dd3e620333c751d7b28d85d76c239c7fafcdaa71aeda4dc9b76c77145", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689791151, "uuid": "741d8c86-ad78-4e1e-9204-de8c51c9ee23", "comment": "Malware payload (RedLineStealer)", "value": "c6eec303a933ce067f5d8ac49c6efb21f61142e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689791151, "uuid": "01774abd-aee0-4833-94a8-5396e966260f", "comment": "Malware payload (RedLineStealer)", "value": "5361e4a6b7faad069ecb336f513945455e11f951d3ac3b13f2626abad42cb2b8562e225978c23584600edd5fae1282f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689791151, "uuid": "069a301c-3dd3-49b2-bbc8-beaa91fedd51", "value": "T11BE2F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689791151, "uuid": "793a47ce-93ee-41af-9156-d7662fa329f0", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689791151, "uuid": "5cd84a46-149d-4208-bb8a-7b3ed05e4b00", "value": 31281, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689791151, "uuid": "0719d75f-3d2f-4584-b477-6793d66e5871", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689791151, "uuid": "fc9c4f62-fc81-479e-85a0-15aebfc0f152", "value": "01097d203000288cc8ef629b9b830dd2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95c7a544-266d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689796260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689796260, "uuid": "89277568-214a-484c-ae0a-1c5fd9a4970f", "comment": "Malware payload (Amadey)", "value": "b93f1a3f111ee22a2f3823ba610df83f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689796260, "uuid": "140ec20e-65af-4673-ad9e-99a045b11957", "comment": "Malware payload (Amadey)", "value": "9a3f5d3f84858840f8bdd8879b66a6c1ccb772e507f7f09dfe1c5a88e2d33db2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689796260, "uuid": "d6c6cb19-7807-496a-ba5e-d3b8d36ec33a", "comment": "Malware payload (Amadey)", "value": "baec460007c3386a3ae433bd896bfb94a70bdc3e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689796260, "uuid": "eaa2c57c-4d58-44d7-901d-4ff6e9677693", "comment": "Malware payload (Amadey)", "value": "cc8a858301c9902e090883eb0fb17673b40a4b7849cb8f86edbe8e3fa50a925f0ab17dfca8cf5b0864bd0eb21ed44798", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689796260, "uuid": "a3cbffc3-595a-4e13-abdd-c57cd697b029", "value": "T125840243A7D98033DDB5277098F603831B3ABCA19975437B2791A94A1CB3984E9327B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689796260, "uuid": "c925db3a-3005-4453-8c4c-6831e1fe8f04", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689796260, "uuid": "ecb573b5-051a-4fc3-898f-7db98d095e10", "value": "6144:KVy+bnr+Mp0yN90QEtnrqjIgNYmaprhm7Wy1NEgVNxfCcHnlRH9sCPRmPZGn2RM:rMrMy90PrYNYmaprhYMcHnl9i9RG26", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689796260, "uuid": "a4499579-9f17-4338-ba9d-0d76613b67c7", "value": 399872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689796260, "uuid": "9b8b4796-0df2-41bb-80c7-8d1765eb00ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689796260, "uuid": "dfee11c1-e8d0-4840-a856-2f0e48bfa1e3", "value": "9a3f5d3f84858840f8bdd8879b66a6c1ccb772e507f7f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4751ca35-25fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1689747595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747595, "uuid": "c7e04551-cd26-4c19-8d89-4bc0569817a2", "comment": "Malware payload (AsyncRAT)", "value": "b61c2bfecf60e226fc7227ef7e093677", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747595, "uuid": "68165927-90f3-4fbd-b6c9-27616a84960b", "comment": "Malware payload (AsyncRAT)", "value": "9abf9cd94bb4fbbbbb189d3e318d45dd6042532c7f73c6a4a920c1a256ecc09f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747595, "uuid": "6a74b549-d5b8-40eb-8028-48d9cc1e6af5", "comment": "Malware payload (AsyncRAT)", "value": "3960f44dd004c0b27ca093aec83009162deec01e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747595, "uuid": "5d0c1a7a-be6d-4576-b344-f060b98f9128", "comment": "Malware payload (AsyncRAT)", "value": "c78a11b41facaf7a30a48ed465099e5071a446a8fc64b5b74027f19ad0538dcf222bbad55779a1a0b762d7fe3cd8df07", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747595, "uuid": "d07de3d4-3586-4c9a-8e4e-f0c3f904c0e0", "value": "T1B755CF1139C0803ADA7331320A69F7B64ABFF4701B655AEF13D8197E5F706C16B3626A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747595, "uuid": "b4a00046-11ba-42b7-88d8-527811b17c11", "value": "ea2d297e3bd3b5b7def0556d0ff46651", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747595, "uuid": "ebc39204-1d1e-4c57-ba56-4d0f37fb6a2d", "value": "24576:PKK5UKlzyC0rG3ElzweHbF5a16lJie3PGDDcz9lbAUm:zlzyC0rG3Elr/a1aJP/ycpeUm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689747595, "uuid": "3b7a4676-7a54-4c65-817e-b12c7b8ef8af", "value": 1296352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689747595, "uuid": "e5030556-a806-4b79-b5c2-99ad7cfbffe6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747595, "uuid": "4b173beb-296e-485b-b6f3-f31fae5c6438", "value": "b61c2bfecf60e226fc7227ef7e093677.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76ed8750-25fd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NanoCore)", "timestamp": 1689748104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748104, "uuid": "7cd0c047-c03f-44f7-8b56-3936eca79da3", "comment": "Malware payload (NanoCore)", "value": "a5b653043d8ff8bc91e32812d858e08d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748104, "uuid": "57ab9e70-4c5a-40b4-a33c-7b72603493ca", "comment": "Malware payload (NanoCore)", "value": "9ace84432d75c544407cd431881ac11ef75b60b5ae55f1375ef50afd6a8fb6ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748104, "uuid": "57d58694-912b-44a7-92f2-e180bfe6bc65", "comment": "Malware payload (NanoCore)", "value": "6883d185eba551c8eaddd9627b971e08f9c0ccd7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748104, "uuid": "de827fc1-1dfd-4069-b057-7b3c18523c50", "comment": "Malware payload (NanoCore)", "value": "2a0773ffdc6ebe631c4d4ca108ba928d38e094b55397d0ce2562bd0b6ab460da7653ccd3a10c8d0182fc757f22c1459c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748104, "uuid": "61c2d299-c23c-4b79-bbff-c52e95b61f79", "value": "T1A7F4231A2775D06BEECB3C3A2E36A61B5B61F2052192539B7344CC857A32784FB4C2F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748104, "uuid": "b48e170a-e4b7-4b4f-bb1d-ce2afc06bb59", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748104, "uuid": "186d736a-a543-4aee-b3f0-9e927e9019cb", "value": "24576:cAteRR5D8pyagTQM708aNGWfotYvCX+e8tzegS3M3VS:HgVDvhQM708UGWfotYvI+XzegScFS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689748104, "uuid": "f673762c-ef2b-4ca4-ad13-2cd35b6d5539", "value": 788520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689748104, "uuid": "5cb7cad5-bf3c-42a1-a9da-d35a60a15645", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748104, "uuid": "006fd23f-46e9-4524-911c-12051f482679", "value": "???? (NYCU 2307-19TW)\ufffdpdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dac46710-260f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1689756003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689756003, "uuid": "4147bf9a-7d54-47de-883d-aaa5fcf831df", "comment": "Malware payload (DarkCloud)", "value": "fbd4307dfb98aeda1bc61cd4d9423594", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689756003, "uuid": "6576d932-97ec-453a-b2b0-71685d1e0691", "comment": "Malware payload (DarkCloud)", "value": "9b7e62b5c34434fcc81018f4c5354a44ca686449746688d63868b0e72ecd8e08", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689756003, "uuid": "1909017e-5361-4286-a87f-cb6abb164d86", "comment": "Malware payload (DarkCloud)", "value": "84499c9f35692a371a8671488ca24d4d2e299198", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689756003, "uuid": "67924a80-4dc3-4925-a3b3-446d39c2035c", "comment": "Malware payload (DarkCloud)", "value": "b7505d675f4b93b09a03e8db484cc4172ba8a71a0d41fff2795bdd050dd091e5be22e7725fef93d4c5e658e8aaba8027", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689756003, "uuid": "7d25db08-e78d-4120-bea2-5cf5694b38ac", "value": "T1BA94233F95DF94740AB9A4192F4D4E9080217362F29D676C7B6A312CF0ADEA3A713E14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689756003, "uuid": "5f7d2a0a-f553-4753-b65c-1976fc17de0c", "value": "6144:ApU8PLMqM/MuWksmSSSe1Nw1HKE/K9Q3oLzH/iIXbTwFbJESJUi8IHscwwV4TeUb:KPLgBsm31vEi9pKIXwdJU9rnKMMBXc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689756003, "uuid": "51cdd28a-1af5-4a79-9244-745ad9f85091", "value": 437009, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689756003, "uuid": "49a8edb1-a746-47c8-a98f-d9b7f5ee5ee3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689756003, "uuid": "e97875a9-763e-4321-823f-14189b15112b", "value": "BL-SHIPPING DOCUMENTS.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e327df85-2632-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689771049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771049, "uuid": "8170a089-fb1d-44e9-a30e-c09becb6f0a0", "comment": "Malware payload", "value": "7012ae2aca575c5ea84c0059d99213e5", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771049, "uuid": "50877ec7-4911-4595-ae1e-782d210a62e3", "comment": "Malware payload", "value": "9bacc7bf50ddc65f4d50691d4d51e796218d0ed131d032cd348121484bb51a55", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771049, "uuid": "6cfcc3cd-5238-4100-b02a-92bae0d27b7e", "comment": "Malware payload", "value": "11f78269d13938c00efc8c8b4980ec7700d11ef7", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771049, "uuid": "d66108ac-9790-4907-af4f-8d87fe818163", "comment": "Malware payload", "value": "c48ccb1dd9cb31eb88824f18d7fea92a862d2068fe7d5e018b48b4edf84551a8d84aba7cd69a20bb1735f4ae3a853b5d", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771049, "uuid": "3056b7d0-1bbb-4e7b-ae9f-eacbf259666b", "value": "T1A5B4F100728CDD9DE68207F97976758EA01CBD7336D6A2C3AE88F30A8536FAF5117914", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771049, "uuid": "c70b2738-1dbb-4b7a-83ec-41047441e8fb", "value": "12288:8OZioWQmmme6v3QLQuEZfWQmmme6v3QLQuEyB2fSnzEa5FZx1Q:pWQmmav30xgWQmmav30x/BTzEgrx+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689771049, "uuid": "2d78bbec-90b5-4b4b-b0e4-e323b45e8605", "value": 523776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689771049, "uuid": "3ff6bf21-9459-4e96-9d6c-cfbb11abbd97", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771049, "uuid": "8a1fee91-b786-4d48-904c-bb7f8b98301b", "value": "\u0417\u0430\u044f\u0432\u043a\u0430 \u0437\u0430 \u043e\u0444\u0435\u0440\u0442\u0430.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d987f3f-2629-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689766825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689766825, "uuid": "ab51f9c9-565a-43fb-9063-25a649607bd0", "comment": "Malware payload (RedLineStealer)", "value": "87535c0c59d9bc3c24104efc10c6e0c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689766825, "uuid": "e4b3376f-d223-48d8-8897-70b6d8a767fd", "comment": "Malware payload (RedLineStealer)", "value": "9bd601cb34b227a32e9e5f75770e355e9b8c41c993b0c7ea102a79e34bad2228", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689766825, "uuid": "ceb6764d-77b7-4610-8fa0-2db8b34eb7ce", "comment": "Malware payload (RedLineStealer)", "value": "2e79e6f3d8073a6fac1f6f6ed16ed6924d64ec62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689766825, "uuid": "3195ae84-f7a2-4961-a944-13bf0c607b5e", "comment": "Malware payload (RedLineStealer)", "value": "bc09456ff9c4fc05a9db8d41bbcd843d9c4e58ae8159cd618a13f85071056587e8a907aadc686ecd62f9022a48d0fc89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689766825, "uuid": "851e9101-8f50-45fb-808b-03e7bfec6aa5", "value": "T10E840103F2E88073D8B42B706DF716C75E36BDA19878836B2755A95E0CB2AD1A131377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689766825, "uuid": "7312cb68-46c9-43b7-be30-3fbfa78793ab", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689766825, "uuid": "0dce95cc-0b6c-4c9d-83bc-5564b03db4a3", "value": "6144:Kpy+bnr+Dp0yN90QEKi0vIfFI2Y8BzFYw1ZF1tN03XQyUgtGyWrCz64kQ8:rMrTy90HDLYSzWw1f1tNsQyjttXV8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689766825, "uuid": "19d15d3e-1b18-4961-92fa-4c7c85f78e6c", "value": 398336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689766825, "uuid": "f5c2ca2b-3132-4758-b08f-4693ea45c0df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689766825, "uuid": "99353fe0-e7b7-427f-b914-be5ab985fa73", "value": "87535c0c59d9bc3c24104efc10c6e0c1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "250ab4c9-25fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689747537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747537, "uuid": "8d497f62-db9a-4f7a-b6eb-937a09d4ba6d", "comment": "Malware payload (AgentTesla)", "value": "61e54986cc14a9b422a4676abb199e88", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747537, "uuid": "23dfc791-5de7-474b-b165-370d6f5f033e", "comment": "Malware payload (AgentTesla)", "value": "9d85da4e6e3fb588cc9d10bb052a4c2994859f2b49fa60e9f012e78a0d8cfa50", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747537, "uuid": "7e2183fe-02e9-40cd-a9fe-34514c32ed66", "comment": "Malware payload (AgentTesla)", "value": "e5bd34d9336dff0302f2052b25986ec080bf2202", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747537, "uuid": "60cd5eaf-f7ec-426f-91bd-28ba929b3593", "comment": "Malware payload (AgentTesla)", "value": "a36ce4b413a12b652e824ad81f4e5e6cfdfcddf5d61fe665e7f2e4dd2b8bf7f48696fd984a0f5a78322978fbb810b9e7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747537, "uuid": "5cf6f425-a214-4031-9b03-fc7586daaeda", "value": "T1FCA4231BB335857D5042E48284DA8F7453B57C7EE5EA7E22E611B6C32CD3EAA4E84708", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747537, "uuid": "89c1a54b-cdba-4572-a105-31d64f582c8e", "value": "12288:lwxIad1iLbOJADEG4I7dS4LCR7ZPjcO9M35OBEp6:l+FWbcAb9pCbPkJOB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689747537, "uuid": "ce001596-f66b-4ce7-ac24-504ed946058b", "value": 459419, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689747537, "uuid": "36dc3a61-ff35-4ed4-b5be-2dcca5678206", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747537, "uuid": "df666acc-06d6-43f1-9ec4-d377a8fe73af", "value": "Scanned_CORRECTION-AMENDMENTS EFFECTED_SHIPMENT DOCUMENTS Tuticorin MV GRACE.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9a6684d-25e5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689737935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689737935, "uuid": "0a875cbf-e572-47d9-846b-480d53c69640", "comment": "Malware payload (RedLineStealer)", "value": "79d695993551d95d1dc462067311249d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689737935, "uuid": "1df7033a-3962-4b97-ae75-c8024ed4cb80", "comment": "Malware payload (RedLineStealer)", "value": "9da891fbecacaf934f0e24ed59d13540062b32165dd914857a8af4109cc6340b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689737935, "uuid": "52d2ae2d-c6e8-4951-8e5f-f07611f14395", "comment": "Malware payload (RedLineStealer)", "value": "a09b6be89d4cb4d0e77d654b80bf73871fc5ae90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689737935, "uuid": "f27db8a3-5ea3-45c7-a039-34620f65be46", "comment": "Malware payload (RedLineStealer)", "value": "4d033013ea591e03b0e4d1587f3b744e0c39f43a3d8f9944c10c48153ef1764646f0b83721f2c8e6168fdb1313bb7a1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689737935, "uuid": "a48cecdb-5e94-4b44-af84-f412aefdc612", "value": "T17304D558324BA57ECA7F883D9C700CE0677CAC665246AB078D8EF4E43D3A7919E051F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689737935, "uuid": "49e6b5b5-d844-4748-b6cb-241850f96bbb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689737935, "uuid": "f4b9951f-de05-4170-b3c8-603e8cee8cd7", "value": "3072:cMC/Huw6uatUGpExN8aOqcJ9Fw/8e8h9:cK1Uef9DFw/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689737935, "uuid": "e6d0e6b5-8ccf-4fe9-9699-3325d67fd90e", "value": 179820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689737935, "uuid": "23b9c7ee-8b87-4256-b9cf-1193af4bb970", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689737935, "uuid": "50edde1c-5bba-49f8-a67c-204b76d9ad66", "value": "j2624853.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7f9d804-2659-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689787808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787808, "uuid": "5cbb704d-6a4b-4ede-af37-9969030cda5f", "comment": "Malware payload (AgentTesla)", "value": "764cb439deb85a06073c46f475956fc4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787808, "uuid": "6b9df9b8-2b4d-48df-822c-f3738eeacc06", "comment": "Malware payload (AgentTesla)", "value": "9db20870570e93875292e6a6a5f7683982cbe675135032c7dafc2b9704f3cb06", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787808, "uuid": "dd15dc22-6436-48e3-8833-92eab2e2d3a6", "comment": "Malware payload (AgentTesla)", "value": "cfd265f85f54b84b0ce27d9d3a68fef3d6974b49", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787808, "uuid": "e5a8bb12-4b28-47a8-ba0c-5fc0c218b7a7", "comment": "Malware payload (AgentTesla)", "value": "543fc812cc092614f100e1f2655970a895d5b202019c0346d5e4bac538db0f32e8da627c263c166510fc9acaac7956bf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787808, "uuid": "713c4630-981d-48f2-9d66-08d2080bc86f", "value": "T149D423046B7B466BD2AF5F75692633F48279CECBF823E7AB0C47F696E9153411230122", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787808, "uuid": "8fb1bc9b-bd73-4100-86e9-1164827c7b99", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787808, "uuid": "89b91ebd-13d8-4a12-b42b-67cac9fbc25a", "value": "12288:2S6ln+flo/XciMvPSh6ZX8p/l0ZankJEDggbQbp/k2oA8JqGTOmocf:rTdCjEahkMxl0kkLvd/k20do4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689787808, "uuid": "2176efc7-1c4e-41c6-a80e-63e0f937f7cb", "value": 648192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689787808, "uuid": "9cbed63f-0c41-4c22-80c5-7043c3e16e4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787808, "uuid": "d850a214-b1e3-4c7a-a67a-4e4a00cc7eab", "value": "SecuriteInfo.com.Win32.RATX-gen.30000.10100", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2453575e-25e0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689735510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689735510, "uuid": "c8317426-1282-4ee7-8a1c-d93248ed0c6c", "comment": "Malware payload (RedLineStealer)", "value": "43688ea74cc3a20234318c2afd4ac108", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689735510, "uuid": "f04ded14-faa4-4c77-a6e0-76b1f5a9336c", "comment": "Malware payload (RedLineStealer)", "value": "9dbeb97d3e399a98ae9589badbae4625fcf17740666286fde3857833f254d67b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689735510, "uuid": "48f08e00-5dba-497d-a19b-d69e537e77d2", "comment": "Malware payload (RedLineStealer)", "value": "827e54c49376caac05f8b3a81fff5b7f13a41293", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689735510, "uuid": "8179d387-dffd-4f88-9f3b-c3790098f995", "comment": "Malware payload (RedLineStealer)", "value": "72e45d321f891d96548f4cbf21cd8540534d7e6733a5acc0d3807116446dd7a9611df2472607c6660cdbe332057f89c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689735510, "uuid": "f9d1ffcd-96b0-4066-8221-613f5afed5e0", "value": "T11104D558324BA57ECA7F883D9C700CE0677CAC665246AB078D8EF4E43D3A7919E051F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689735510, "uuid": "27ea68a2-b955-4ec7-8f19-e002e4980dee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689735510, "uuid": "ae5c0741-8ed0-4802-af89-4fc04038cbe0", "value": "3072:cMC/Huw6uatUGpExN8aOqcJ9Fw/8e8h9:cK1Uef9DFw/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689735510, "uuid": "9c95c6a1-137f-41bc-bb12-0154630a5363", "value": 178065, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689735510, "uuid": "d44a13ff-4be3-4c7f-9c98-e32d08c2e3cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689735510, "uuid": "6af01724-16ba-4fe6-8a3c-7b28a609f944", "value": "n5501758.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acf1c63d-25ce-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689728009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689728009, "uuid": "b67abf8b-7df2-4578-9fe8-996f5df35f90", "comment": "Malware payload (AgentTesla)", "value": "864756eb8d42541210e2e03aaf646548", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689728009, "uuid": "9a3ae387-b71c-438c-b5fc-5de07bba1fe5", "comment": "Malware payload (AgentTesla)", "value": "9dc5c3e63c6d2915ae639d5ea176bdfdb108a469f3fd84319ebbc410d1fa151d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689728009, "uuid": "a5a5a368-d896-4f06-98ba-d7555990cadf", "comment": "Malware payload (AgentTesla)", "value": "93b2ab3f0c7bd69316687a5fdf307d9701be553b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689728009, "uuid": "8e4645ac-549c-4004-973b-52159a64cba5", "comment": "Malware payload (AgentTesla)", "value": "f9c1bb0835567a58c06e7b685f8ab76b3a6521764376b351b87c60e93eed1463280a5fe3c4768a0dd8daeb4fc761e16d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689728009, "uuid": "e7d23a76-6373-432e-a892-7c68ea426591", "value": "T13445BC012EDF0108E1B7AABB5BF914A85F7779B2A439C55C644E1A090BEBDC4BD10F72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689728009, "uuid": "1fc0e007-163e-4635-bd6f-2e0870915aa3", "value": "6144:An+vMxzakCYIqO+usl2tSc9RVZ0BPpPj:ZMxzakCYIqO+usl2tSc9RVZ0BPpPj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689728009, "uuid": "0380b8a8-ebf1-4be6-ab81-885be6e8edd7", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689728009, "uuid": "7ed419c0-eff2-4d22-a0c0-742924c53ea2", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689728009, "uuid": "3cc12494-939f-4168-af57-7a3e08479ba4", "value": "n##..080933400c.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65f27dbc-25ff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689748935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748935, "uuid": "9567a775-fa4b-4175-b0c2-ac8c222ffa5b", "comment": "Malware payload (AgentTesla)", "value": "537d2429832396b472388a132747f419", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748935, "uuid": "31846661-6f0e-4b8d-8344-1e881b4170e5", "comment": "Malware payload (AgentTesla)", "value": "9e948efb303da97d8bc0a90d8b3b039f5c20fa20cd5aa6a6ef2757664815775e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748935, "uuid": "32eee59a-88da-43e5-8cc7-6100a009b969", "comment": "Malware payload (AgentTesla)", "value": "20026ab3983c740ae4d7b6f5122f834ab449c87c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748935, "uuid": "960156ef-cdb3-45eb-bd61-124060fa5403", "comment": "Malware payload (AgentTesla)", "value": "ca9a4f9428236a24db8e14824cf1c2b53c7f6b8e71b3a30d58a8ce7eee11603e933c097919392e809e911b2980850ce5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748935, "uuid": "8a3096f4-62a8-4ac1-b465-378b70c5ee40", "value": "T185D422A19AE8CB27C1E863B807507B4143FECFCA5415E21C5FDAFCD6B18E32152516AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748935, "uuid": "f127b64f-daac-4b85-8ecf-943850a9284a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748935, "uuid": "e8647c16-9b1a-40ee-ac61-90f070461c08", "value": "12288:XPYPfY7dAsoXbFlAvRwlhxg6ztqPn1VLybPKqNb8E5+:XPYPgpBExlAval42qPHWbCabD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689748935, "uuid": "099b47f5-0a99-4464-b815-85940de919d4", "value": 634368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689748935, "uuid": "c46f4e0d-f1f5-490f-92ee-898983cdd03f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748935, "uuid": "1534e392-8aca-4a35-8c97-fe58fa47fbd9", "value": "537d2429832396b472388a132747f419.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1572ee0-2632-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689771073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771073, "uuid": "e629f3aa-e8e3-49df-a0ad-3b47fa4ddf40", "comment": "Malware payload (AgentTesla)", "value": "de0aea0706ec4a4bbce963671ad890d5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771073, "uuid": "02b7cda7-0ea7-4468-92f3-2166ee22cf78", "comment": "Malware payload (AgentTesla)", "value": "9ec15221b5d021929dc382445e850cfd54ba558397f22b12c7beac36d6184242", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771073, "uuid": "99360d28-69c1-436a-b401-ae2924514db8", "comment": "Malware payload (AgentTesla)", "value": "365ba39c791bc5aa16fce672bbea3d24f467488c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771073, "uuid": "e8247338-00da-40ab-9cfb-822fa0b6113d", "comment": "Malware payload (AgentTesla)", "value": "45e22e81cf90393b210f08cecb3cdfef528136ad87358b49cb3bc3fd0685dee93f7695f99dfc5c820287c1ab29f196dc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771073, "uuid": "99bf180e-3eb5-4a74-a786-26f34979fcd4", "value": "T1DC35DF03DC049B83C50D87F47E131ED94F0A7F1AE89A6DDB05527F9B3A32A72886A51D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771073, "uuid": "68012587-6227-40e5-ae5a-17e7fa78515a", "value": "24576:T6ZySw6VdMn5ZyUw6VsoebNcwcA5YmgT0/SawUxO:Tk66VdMjk6VaNjcsgQ/3f0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689771073, "uuid": "a1c00460-827f-437b-9f73-00f24081f329", "value": 1102848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689771073, "uuid": "e0406768-5dfa-4699-9adf-65325de7811f", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771073, "uuid": "f007215f-ac17-43da-90a2-c59a4c68d19a", "value": "TRANSFER_REQUEST_FORM.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc496c30-260a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689753858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689753858, "uuid": "ace2e6ac-4a94-45ef-9869-3cb55ffbbb9d", "comment": "Malware payload (AgentTesla)", "value": "f81ef2ce00710832c4014635cd40e544", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689753858, "uuid": "5f3e22f5-ade6-4fca-be56-b7d6846e5959", "comment": "Malware payload (AgentTesla)", "value": "9efc36a1bb544ad144466805bc505ab8240237a01bbd45ef2813f2a513ca885a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689753858, "uuid": "317608a4-2f4a-4702-96d9-ca582a941529", "comment": "Malware payload (AgentTesla)", "value": "2b34e4a289c44161c787bcd08df8227cc1b2b43c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689753858, "uuid": "ff6ba0fa-734e-4db0-965c-75b4bd26bd3e", "comment": "Malware payload (AgentTesla)", "value": "2ab92ff3c1c9aa67834b2e6b116d52bff3add76b45819b033bae5fae6192683abcccb9529e0e019e1caa38085f29a6c6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689753858, "uuid": "bc7e9a78-be2c-4f46-a0e1-5ece37ac06c5", "value": "T1F6D412517AB84713C5B9DBFA5228674013BE9FD96461F42C9EEBECC731A4F140A90E0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689753858, "uuid": "60e17a65-c3b4-401e-9807-d8c9348210be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689753858, "uuid": "d4815a70-c534-443c-8e37-0dba939fc1f8", "value": "6144:pSniydiQAPAjPP+iY7umhEyHirJRve6zWtAKKCEFbhE+8Eq+yYkeUBfctE/399q7:yyPYPfY7/Cr/CO6EqBR9cC9Ci", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689753858, "uuid": "0fadc24b-5b8a-4f9a-a260-dd9cb8d352b7", "value": 645120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689753858, "uuid": "5b35b48e-32bf-4373-a17f-ef49c8f2acfd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689753858, "uuid": "354fd19a-ba1c-4fb0-a122-9718b778a9db", "value": "swift 12567196618420067.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08aafe3a-262f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689769394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689769394, "uuid": "725d73ae-4660-474c-bdd3-4f3c1fdc59aa", "comment": "Malware payload (AgentTesla)", "value": "547c4ab435c398a297f9b425311f70a7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689769394, "uuid": "82b098f7-00ff-46e9-b0f7-3b6354b3829e", "comment": "Malware payload (AgentTesla)", "value": "9f08469a0b761c0d950446b84a2cdba032bc93c0f92abbd63352ec399506248d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689769394, "uuid": "d6397d17-b185-477d-814a-f30ba3f6f6c9", "comment": "Malware payload (AgentTesla)", "value": "7feac760af6e4aa7b7660b7beda145e057ad6da3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689769394, "uuid": "37e5a3e3-52d6-4b26-8244-603be8c5f479", "comment": "Malware payload (AgentTesla)", "value": "49bb1d21c7ba3c9994e5dc937c2c0478af6a721e84b14a480783dbc935c540e3807f45e3a1aa30da6a83403ca262f1ed", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689769394, "uuid": "dea7d94a-d961-45c1-b69b-72f14a5acb9a", "value": "T164D4120039A45323C575CBF90274AB4513B69FDA24A1E12D8FEEECDA71B5F185EA0E07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689769394, "uuid": "40ff8f3b-834e-44a8-a14b-b5b7f7e6ae5f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689769394, "uuid": "00e29843-61a8-44d0-ac5b-29ca2aef4a07", "value": "12288:S1PYPfY7RwWJNKwp0mlVvwMb4zcPGSpqZqH2H3+cZ64FUNgv4:yPYPgNhMH8lwMbq/SsZqU3+cZl2E4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689769394, "uuid": "2019f2c7-7bbb-4837-8914-4b4b64677111", "value": 646656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689769394, "uuid": "6734a5b9-a963-46f0-9a32-1e74d41fe535", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689769394, "uuid": "8d35e7f6-59e7-4ebd-93cf-f60de31334e7", "value": "547c4ab435c398a297f9b425311f70a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cb083c7-2610-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1689756274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689756274, "uuid": "feabc0bc-45de-4c39-a4aa-fdebcadc6507", "comment": "Malware payload (Loki)", "value": "86734f4ae70bf0ed90690ae3bbbce9ce", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689756274, "uuid": "19466a7d-2b94-43d8-9e8a-ff065554222d", "comment": "Malware payload (Loki)", "value": "9f7f823f2cb4020d800005528ced545600f07a24ce30f73c84b59ba32994fa52", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689756274, "uuid": "45db990c-e993-438c-9971-477fa82d75bf", "comment": "Malware payload (Loki)", "value": "a405221350ad6d72a71777d1b97ee41a1cfeb011", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689756274, "uuid": "975a8049-e0c6-4c90-b8d7-e7cee4de51c8", "comment": "Malware payload (Loki)", "value": "b3dd8a4f5cfef752a488831edcdffa2eda0d515dab75e69720a9ba8f8f17888cbeb6996851847c07a3366d90faa61450", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689756274, "uuid": "0cdfcffa-5d9c-420f-bf0b-468bbd8f9196", "value": "T1F5B4233153D1FB6FF493A77E8422EA34115BC3114AB1A86EF02FE13991DFEA21861C95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689756274, "uuid": "7e6aa2f9-81e7-4bc4-9285-f4d924c09b82", "value": "12288:20BMfSN4ZpAmgjj9y0lDlefxd5VEwthPJrE+ItgofFV6:2IypGJlDQZd7EwthP1ItHfn6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689756274, "uuid": "9001f90e-12ff-4fbf-839d-5177f3c916a1", "value": 512434, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689756274, "uuid": "6dbf0850-e5e3-41a6-9960-4d7d71e7157a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689756274, "uuid": "1f6a2535-6f57-4d6e-b2fd-16c92eae5517", "value": "D02397801.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "897c40e6-2625-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1689765315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689765315, "uuid": "1a70965a-32fa-465a-a2c1-86dfd32e4489", "comment": "Malware payload (GuLoader)", "value": "838778261bf67528b4a3d8f70616777e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689765315, "uuid": "aa70e110-6cd0-4c70-b51d-000cda21f604", "comment": "Malware payload (GuLoader)", "value": "a02ec2909c9fd5e1f0637bae5b0df4676a3ae68990a5a03f3ba4e6e16ee86316", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689765315, "uuid": "ca005719-e418-491c-aa78-6ba05391eaf6", "comment": "Malware payload (GuLoader)", "value": "a69f6e027557b9f38275987f3ade9577a1749cf9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689765315, "uuid": "31b41b6e-28af-4ab9-9bcd-d31e77b7815f", "comment": "Malware payload (GuLoader)", "value": "e53db405d19eec8331b36e94cbd3bd54ba57be6e42a6ccc4f0f503e8f19aa5bef5e9a0d28c17278471fd37ee001a3897", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689765315, "uuid": "8242b61a-4ed3-4c88-870f-1fdddc73741a", "value": "T155B412227658D167DA610FF10DB2B9AA8AE48C11FC74E60F635D386D7BB03E16D0E316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689765315, "uuid": "aaba0388-e9d0-4db2-a849-1bbee1286e90", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689765315, "uuid": "3334900d-3d26-4e2f-9eec-90dfa40fdc09", "value": "12288:CQIzlMDWB52MtAaD1PZnx60wuekVG1K7mN:eRMyj2MtAaDJNx60wOEciN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689765315, "uuid": "e6d91a27-cbd0-4a00-bc62-ca25e2686953", "value": 526814, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689765315, "uuid": "270a2467-9dc0-465e-9396-a985d29720a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689765315, "uuid": "fab59a0e-575c-48c0-be82-0e104ce7949d", "value": "RFQ02578.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af52b58a-263b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689774828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689774828, "uuid": "da1e335f-6e18-4d00-8155-559c9e6e90f1", "comment": "Malware payload", "value": "91bf8aba16f07cb59ca9e443b9d57d92", "object_relation": "md5", "Tag": [ { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false }, { "name": "WSOWebShell", "colour": "#C53911", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689774828, "uuid": "e8be6a7d-960b-4c6d-ae1c-2ebb13e1311c", "comment": "Malware payload", "value": "a07191c00c2d93a9f8e7158df87e237af2e20e5a335d3e9c3581573f3084877f", "object_relation": "sha256", "Tag": [ { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false }, { "name": "WSOWebShell", "colour": "#C53911", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689774828, "uuid": "a7b5311b-587f-4efc-9aba-71a3064b4e7d", "comment": "Malware payload", "value": "b483f209946fc54792168a042f69142e5b732726", "object_relation": "sha1", "Tag": [ { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false }, { "name": "WSOWebShell", "colour": "#C53911", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689774828, "uuid": "9352a175-03e4-4a63-bbdd-6fb3fc423949", "comment": "Malware payload", "value": "88a993239dee85c351e5e0c2f5a6f4662ecc395a28029de0d4faeaeeee30c7f65aaa1b4ca8ff8c5c8719f08abe71aa6b", "object_relation": "sha3-384", "Tag": [ { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false }, { "name": "WSOWebShell", "colour": "#C53911", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689774828, "uuid": "fa772944-8ad7-49e0-8707-2e82d82ec1b0", "value": "T13854DDC56B89C9B8CB2FF46872199C57CDCDD219262DD8C3ABD32F0935128B876798C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689774828, "uuid": "2294ebca-fbd9-430c-8a09-344a1cc8af9e", "value": "768:snw7P53nX5vr/gJXuGV5JxQA38qR69bhzX6Kbvm/Zx4X1dOyKCw/zcY1ZYF0r/vo:N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689774828, "uuid": "d9404aee-d0e7-4128-b051-2be487383e98", "value": 294932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689774828, "uuid": "d97535a6-dc2d-444c-8f04-f59f9fb385ac", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689774828, "uuid": "6c2fbbe4-167f-4bea-889b-f4d52e35daa5", "value": "C0xX506s.dec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "089a08bd-25e0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689735464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689735464, "uuid": "01e294c0-7071-41b4-a365-644f2d6e2dc7", "comment": "Malware payload (RedLineStealer)", "value": "d7820de9519615478a5f25bb046d9883", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689735464, "uuid": "f83d05f4-6f84-4984-a92b-30efd3998b61", "comment": "Malware payload (RedLineStealer)", "value": "a07a7ef40715d0d4ad9ab46282593abb1899648790951e9e48af37c593c5385c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689735464, "uuid": "3d9b512c-3786-49cf-b8cf-ec0e8253a012", "comment": "Malware payload (RedLineStealer)", "value": "9905ccef7eeedc7e435aa873013a4357cbc5ba3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689735464, "uuid": "a1ac07e8-6d24-430e-9a6d-c245e17c3649", "comment": "Malware payload (RedLineStealer)", "value": "bc086bfc6a38e668fb68fee88bcacf97894499be4304bae95371b6af7d7f6e1694fa975783cc528169bf6f7b7c124c46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689735464, "uuid": "e8aa0533-fff1-4edf-bc4b-f120d98b872d", "value": "T19904D558324BA57ECA7F883D9C700CE0677CAC665246AB078D8EF4E43D3A7919E051F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689735464, "uuid": "2b440c59-5baa-4533-a705-ec3743bf9eb8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689735464, "uuid": "703b009f-2e83-4585-ab4b-190fe5bae682", "value": "3072:cMC/Huw6uatUGpExN8aOqcJ9Fw/8e8h9:cK1Uef9DFw/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689735464, "uuid": "adaf5581-0059-43a0-9a3a-fe54d294df91", "value": 178064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689735464, "uuid": "9597829b-ef71-49c6-9ae8-cf9f4c3e43f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689735464, "uuid": "15babd01-534c-4e41-b53a-dd411394d26c", "value": "j1692265.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "461fac9c-2659-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689787536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787536, "uuid": "2603bbaf-16e5-444f-9901-9c0e9d8c0e4e", "comment": "Malware payload (Amadey)", "value": "2fc0bbe15bd035c3d407ab95c61c1cce", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787536, "uuid": "064cb585-c298-41cf-90eb-bc08fcea3e7a", "comment": "Malware payload (Amadey)", "value": "a08c8c0525a0dab65a0bba5c1e532d2203142fb5501859e68660535556e9d15b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787536, "uuid": "6971ad55-e11b-4f0e-9e1f-74d1b36f67d3", "comment": "Malware payload (Amadey)", "value": "c1a713f7cc5f0cf446236839f34bc09f7e61e3da", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787536, "uuid": "d3dd8c0a-2f60-4271-9525-dffc10e20d2a", "comment": "Malware payload (Amadey)", "value": "62c1e69b5395b7684f0d7e67168ae19bc62fe4d438b0612570d75225c26768e66fbf35113617cf66d8209915527dff60", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787536, "uuid": "cbf9c818-a90e-4a15-ba7d-1a67ac00f11e", "value": "T158840212A7EC5032D8F41BB068F716931B357CE2A975836B3396981E4C73998B47273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787536, "uuid": "0604d2c4-d5cd-4c52-be1d-37ffd342eddb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787536, "uuid": "a99f7dda-70ca-4808-8216-67e204763514", "value": "6144:KUy+bnr+9p0yN90QE5cLOnCZ9dQN8eALXsGjlmVHCcHnlRHjBd3TttASaqWbK:wMr5y90nfn2uN8eAtBcHnl9jsSaqz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689787536, "uuid": "a0f4502a-9012-4187-be87-c934e73e4914", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689787536, "uuid": "0498a2f9-c6b5-43a6-a7b2-628a07267d04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787536, "uuid": "c0658539-d130-4263-8d3a-07cdc167060b", "value": "2fc0bbe15bd035c3d407ab95c61c1cce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a416af5-2614-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689757854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689757854, "uuid": "a8dfe7b2-6ce7-4aa7-a05f-730cc3990bbc", "comment": "Malware payload (AgentTesla)", "value": "3d98f91135c95bf84113c73e1fe72c89", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689757854, "uuid": "3a845da1-e8a6-46b1-a688-100dfa8292a5", "comment": "Malware payload (AgentTesla)", "value": "a17aff4fb8869530b2c69402afc05eb0daf150972e069fe884cf0c087c6f4cb5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689757854, "uuid": "fada8798-6d27-4c03-aaab-981a6893eecb", "comment": "Malware payload (AgentTesla)", "value": "172e7a32d4f98602eaa159e9799acbad67589df3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689757854, "uuid": "ec9615ea-6be8-4089-be7f-7fb1af5c882c", "comment": "Malware payload (AgentTesla)", "value": "6c5176e52043c4e41fe1614eb79cf93418129f1e63340556d9ddd76ba4516729e78f5adb25289df44443f71bd363a5ed", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689757854, "uuid": "0a90fa44-a238-4ed3-8e11-86d54f373f4e", "value": "T155D423C364E1C6C6F3E1466C143E356BAA87B34BCB6EA633115433885D8F97FA21B845", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689757854, "uuid": "42ddf66d-21ff-494c-bb19-6b7d02645e66", "value": "12288:PHMykbm2CcWhnjwJZNHSVdFZ9vLi1/3BALQI2wSeTJzN85CcIWo/65s:fjkh8nHLFZ96BsSeTAQcIN4s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689757854, "uuid": "81d7c99f-5109-492d-8652-8d1129cffd56", "value": 655520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689757854, "uuid": "22995150-d3bf-4f24-9356-0f3ca6807c04", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689757854, "uuid": "8f724521-9dcb-4a04-9a35-e0552e850bf3", "value": "SOA FREIGHT SLIP.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "489a75f5-2671-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689797848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689797848, "uuid": "b083c347-ce3f-463f-8732-b31ceacb3700", "comment": "Malware payload (Mirai)", "value": "d00977141315478adf708ef1ab63ef56", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689797848, "uuid": "5dd0e91e-8978-44b8-b554-f8fb93c0e6a6", "comment": "Malware payload (Mirai)", "value": "a28006fa1cdfeb2171cc8a78290987510cbbda49d177df87e74dd610a306b19d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689797848, "uuid": "8f44d9e4-f37f-4fe0-baf8-95474e49c09e", "comment": "Malware payload (Mirai)", "value": "b1515dda3d2c9f2744597b5b44e9ad6e4d683bdb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689797848, "uuid": "8fc14db4-4247-4c44-b302-99c0856b0f3c", "comment": "Malware payload (Mirai)", "value": "8fa3b7d27788101cf5f658fe6bca0c35b2957fad2a69efdfeabc2538fc18b7ee965894694c1a8a62804179bf4e6de81a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689797848, "uuid": "b4646420-567d-4b51-94eb-c3b8dc036cc8", "value": "T18DE2F19CA5C428D1C57E0CFC51260FB29E18F564B14F6B9E73118D88BE4AF4B5C908BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689797848, "uuid": "2c655069-30b2-487b-8b18-cf89d30dd075", "value": "384:hn6Ppdqf3I54hJulN7s1kNYTA/fKiFs4V9B6f8Oj0bCwFtNKpugm/kY9rSzLRWGK:h4YuDs1kNJ/fKiFUf8OGCgG8kY9rQ1Wv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689797848, "uuid": "75324258-1c14-48a4-88ed-02883d967c3c", "value": 32028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689797848, "uuid": "b7fe8c3c-d3af-42f5-a719-649148fda15a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689797848, "uuid": "7159c1a7-b1d4-4b0c-8d43-22d9138120ec", "value": "d00977141315478adf708ef1ab63ef56", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cef165a-25fd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AZORult)", "timestamp": 1689748034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748034, "uuid": "e2e48816-cc6a-4065-b5d1-b251e1246085", "comment": "Malware payload (AZORult)", "value": "aa05b4633af686861bb48be0886b7cf9", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748034, "uuid": "240eefef-a14f-4bb4-8218-b42c69457d1c", "comment": "Malware payload (AZORult)", "value": "a30ab0ac4a47342d8bcaf60d8b29444869bde081d06ef00848dee3cd80d80b44", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748034, "uuid": "1f437e17-58f2-4657-aa1b-67d074690cd9", "comment": "Malware payload (AZORult)", "value": "b8f80968be41e864318950ff6b648c3fc7667a66", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748034, "uuid": "0e1892cd-3f01-4cb5-af75-5389d1777552", "comment": "Malware payload (AZORult)", "value": "6690d2d43561d452c34ca0644a50559d4b31d058bd00cb5a35fe8ea27cc12ca8dcf5e20fa2837681053322d9101acf0d", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748034, "uuid": "e9a8d791-604c-4104-adbd-a6cafefa3674", "value": "T18CF302962280D5F7CBBD1A30CE7A1B1367F96B052151154B7BA0AFA775332C3970B28B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748034, "uuid": "27e8a540-fdb6-4724-a984-eadc75cf28c7", "value": "57e98d9a5a72c8d7ad8fb7a6a58b3daf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748034, "uuid": "8cd0b2bb-7f6a-45b8-afb4-baf8449cc81f", "value": "3072:+NzPHk9MpcQbFqO/pSeMvW1mBVTkDfNCkPoDWlXHWmF+Rm3ymaKzwTxmdANo+:+hRFF5BSx6mBVkTNNPoit2mF8m3+Kzwr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689748034, "uuid": "2856155f-21e3-4210-b14e-fa53da24c1fd", "value": 164367, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689748034, "uuid": "7c2e004f-a953-448b-8377-a7660bb12e5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748034, "uuid": "25311007-a3f6-4976-a092-c7887e323ef3", "value": "DHL EXPRESS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "301205da-2678-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689800813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689800813, "uuid": "fbe93b6d-b037-44e4-88b3-6eb4c97d5678", "comment": "Malware payload", "value": "d513f1a45edb0395153cf9250f2751e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689800813, "uuid": "27beca25-01cf-4a59-988c-a11087fd7ea6", "comment": "Malware payload", "value": "a4e34f6a48c37d63c6c8fc2832c4a37451d5e8ca1a3069f627606afa1fea69f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689800813, "uuid": "395397e3-15eb-4c8d-9906-8e5110d95654", "comment": "Malware payload", "value": "308669e5d25044ba75f8af42af030b45df8180ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689800813, "uuid": "1c302b12-2035-45e9-aa75-5eaaf61d186d", "comment": "Malware payload", "value": "f4cf273cf9d1aab8a2116239d0c82cf2722c46b5ac9f1f14799233f40098ef4e4af6913425afe4ce8295116b63a8cff8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689800813, "uuid": "4ae16e2b-d854-4785-b96a-24ad47f9cd8a", "value": "T1E055D0B76C3B068EC5B0233E2CFB790AF6EEE2803C55D51B5DAB07D8C1761945AD2099", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689800813, "uuid": "db929565-f1bf-4cd6-8e77-c18d6021389b", "value": "76455649f85e79f41b63448e060dd2b4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689800813, "uuid": "4c933baf-dab2-4dba-9dae-35cf93d9221e", "value": "24576:pwgMyfGvjZqHY5RqiEijXHLVtsro6fM9aW2CT9IOgTdV9C6paVlz9QZ:pwxyfcdq45Rq0rVtypE9aW2CT97gTdVL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689800813, "uuid": "630353eb-0c17-4017-a4a6-977cdc060202", "value": 1383000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689800813, "uuid": "8f9fee4b-7a7e-472a-9dfc-2e6b3b3666b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689800813, "uuid": "8fa21415-c62c-4e85-a65a-606b4b60aa97", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e35c6ab-2633-11ee-a6f9-42010a9c0055", "comment": "Malware payload (LummaStealer)", "timestamp": 1689771121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771121, "uuid": "619aa1a0-c39f-4bba-a2d2-e3a34162f290", "comment": "Malware payload (LummaStealer)", "value": "92dc3bfc98f9d448b015125231f3bd6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771121, "uuid": "0ce7ba80-8edc-4bfe-911f-1084ef2ad626", "comment": "Malware payload (LummaStealer)", "value": "a58b87f315fd77116edce2744e443d0ce6bab9e087a2ead50626e986314f949e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771121, "uuid": "9e8034ed-6dc0-40fc-b474-c4c3c86c3bf2", "comment": "Malware payload (LummaStealer)", "value": "57e2cbcfa3293069c7f8058fd70bb160797fce91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771121, "uuid": "aa60da05-0d38-4e54-98e1-a55fcc9ef7ac", "comment": "Malware payload (LummaStealer)", "value": "f4868e04f8d5f2f8c357d05e4db9d17f18fa48d71a91af9257e8a6a0218776c37682d939dfc7a4a240087c26e97d3dc5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771121, "uuid": "fd7791e2-fe7a-4df5-bd9b-24e33dbb15f9", "value": "T18F94F12232A08076E4B35A30197192816FBB79729B3555CF37A4233E1F713E1AB74B5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771121, "uuid": "b9b36b07-39f5-4392-820e-795b07151461", "value": "e3ff19f7172c13237bee4639264542fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771121, "uuid": "e1cfd8be-d8a0-4543-994c-b2dae738cb11", "value": "12288:wxqsuSw7uDI0N5o+RwIwZpaBcbT4DW9l:w5w6z5PRw9i+oD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689771121, "uuid": "ac2ad349-c40c-4fc3-a11e-46a6ee23cd14", "value": 412672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689771121, "uuid": "209dc2fe-6403-4bf1-a3ad-dd4dc8eb5a14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771121, "uuid": "abb79755-9d5d-464c-95e6-e087e9872393", "value": "Sat\u0131nalma sipari\u015fi ve numuneler.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8701e82-25ce-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689728028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689728028, "uuid": "13d6555d-320d-4a21-acc8-3e559a7f20bb", "comment": "Malware payload (AgentTesla)", "value": "ef2a9f5e99f829257f866bd08d37bf40", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689728028, "uuid": "1a0f8c0c-635b-4801-9120-318adc19d8a9", "comment": "Malware payload (AgentTesla)", "value": "a693f4ed81f9a157d90b2a2e136e60b14b052a008c5c2a07b5f3cc4540be493c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689728028, "uuid": "0ef8a1ee-2850-4e28-8f9f-ea0b9bd628b2", "comment": "Malware payload (AgentTesla)", "value": "26f820846d1e0ce0e26b6e3dc0c0539a55969df7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689728028, "uuid": "d2a2cd48-a9b9-489d-8f72-a6e81c8cedc7", "comment": "Malware payload (AgentTesla)", "value": "4bce0536ad442f43ba272fa7fa7dff0b9de24b73d0704801ab77796b9a4bab19cc826e785fbe5fac7f8c5c7169438779", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689728028, "uuid": "c71ecc06-bcd3-48c1-ac40-156216ab398c", "value": "T16CD4234482EDCB13C9D853B56761ABA083ADCFD61C29E6690FC6DCCEF80B71413589A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689728028, "uuid": "83a524aa-613e-47e1-8f1d-b57f74724a7c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689728028, "uuid": "f93dac41-5af2-4032-93d9-37b16ab453e6", "value": "12288:pCPYPfY7iLaxrvK11JACJX3WojYHdj4YtuZKzih1BcT6:pCPYPggYrS11OCQojY9VIZK61KG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689728028, "uuid": "13101a2d-73e3-48de-a2f3-c0c16eb320a6", "value": 636928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689728028, "uuid": "36877b8b-acb5-4dce-ac8b-0b4cf8c1c946", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689728028, "uuid": "859b15a1-0ef7-481b-a8ff-8950e492cbb6", "value": "z1IS8pXgHrDupLy5v.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8d6a7b3-2665-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689792963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689792963, "uuid": "7a9c950a-c5ca-467d-afe6-d73ce03a83b0", "comment": "Malware payload (RedLineStealer)", "value": "5adf486ccde6c39d4aebcc156dcb5e68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689792963, "uuid": "4fcfc9d5-f61f-4592-8f75-f402f38c026d", "comment": "Malware payload (RedLineStealer)", "value": "a87f5583cccb846556ed9798e5a676cf44b0c70e7b9beb54493f2c224c67a0b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689792963, "uuid": "4089262a-8334-403e-b47c-dd247841a3cd", "comment": "Malware payload (RedLineStealer)", "value": "47ad91969ca3050c8461db92b3e1dac4052c8c75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689792963, "uuid": "9b63de5b-9921-4243-b297-f5257d78e0ac", "comment": "Malware payload (RedLineStealer)", "value": "d71f936a794bc65a2d10e0086de0e5c0dfed7678f07ea557fa2d2a4034893baba8534bb729f6c8a68b4fc01c5a46aa23", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689792963, "uuid": "893f0a76-a3e2-46fc-b1ed-a5b4c401e6a0", "value": "T1D7840113ABEC4032D8B517706CF712C31B3ABDA1AD74476B3795A92A1C73684A93137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689792963, "uuid": "85c30f82-bab7-41d8-a717-9c4ddd157d05", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689792963, "uuid": "73c61e85-5fb8-4ca0-96e1-b01aafe1173d", "value": "6144:KMy+bnr+Up0yN90QEtwkUBdo33dNyVu1S2Defvjc1G9Euobh9XeEIDXLA8jqR:AMr0y90vwbTo3BE2Sf7YGiPfvIA8jqR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689792963, "uuid": "30b8c2ab-b3f9-4d2c-83d5-c1a7b1b00df9", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689792963, "uuid": "bb31f5b8-b6a9-41d0-b56b-3b2632380ce4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689792963, "uuid": "8b8b399d-ec52-4527-9827-27bf16b87226", "value": "5adf486ccde6c39d4aebcc156dcb5e68.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb143a97-2665-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689792967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689792967, "uuid": "d9a96093-b47b-4594-a40c-9a27a3fa21f4", "comment": "Malware payload (Amadey)", "value": "6f6b129948a313fa52a5fa29afab8d9a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689792967, "uuid": "f03629bb-7297-4552-8bf4-671b6931b32c", "comment": "Malware payload (Amadey)", "value": "a898d72b49cc00c36f48fd52d4f754e3c8b758780323239ea18208abf91a9b84", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689792967, "uuid": "ddbb64b2-5f0b-403a-9c0f-6ac5b74da5bd", "comment": "Malware payload (Amadey)", "value": "e6e75d06359660ed6972eb853ec4f1d9f2494e95", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689792967, "uuid": "99605bc8-a762-43fb-ad14-2626efb8b9e7", "comment": "Malware payload (Amadey)", "value": "04d55d4dcc665fb8e17a55e8563272a1a2610f850facc05482aeead7246bbbb1ce9af40f259a0c332b4725d1f7a22271", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689792967, "uuid": "b43b7e03-d82b-41b7-8df1-f8d008671877", "value": "T1E0840112B7DC8072D9F517B059FA13830B357DD2AD79836F238598560CB3A88A532B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689792967, "uuid": "005be753-b01e-467b-a12d-973d583f720e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689792967, "uuid": "37a3022d-73b1-47de-9f86-8f4afe08e956", "value": "12288:3MrGy904k9KzMkB6suwkohbTcHnl9G9ON:1yRaIMrsdkYAHi9ON", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689792967, "uuid": "f3927629-dc1f-4f3a-b525-e29f97e897cc", "value": 399872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689792967, "uuid": "84eaf6b5-e950-49af-91a7-d8d4c801e76f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689792967, "uuid": "0af91f50-3d84-4c32-9184-a56c7c5cd505", "value": "6f6b129948a313fa52a5fa29afab8d9a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8b5d861-2637-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AZORult)", "timestamp": 1689773179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689773179, "uuid": "3937f7f0-6616-4c49-8517-afde4f952306", "comment": "Malware payload (AZORult)", "value": "25d8a8418c9b74623c40c90bcc31e6e5", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689773179, "uuid": "612f99bf-2326-4ac1-9514-6137d64f2c7a", "comment": "Malware payload (AZORult)", "value": "a964ece7aad2f454cb18516ab65ffcd35aa90574a7801492d5571969dacd7740", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689773179, "uuid": "828bb371-9ba7-43c1-ac3f-246728e2045d", "comment": "Malware payload (AZORult)", "value": "ee0300e46b805eb4b08a8eb6f24618a46a05ad71", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689773179, "uuid": "8c13625f-e7c6-4d7e-8c31-2be05d014b3c", "comment": "Malware payload (AZORult)", "value": "4e62d00cea4c430b1f5d3d1921207ce68d2f563a7ab565a21599a18908563dcf8a6cd46790b34d61655786d3e04997bf", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689773179, "uuid": "b520ff16-a8ad-4c8e-8e9c-47e840595476", "value": "T195E3022B2AE4C8F7D37545314B778A5ADBF4A72651A6239B27D02E6A3437181C90F2C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689773179, "uuid": "bc0e624e-7d8f-4fe9-92ef-dc2edc15b90a", "value": "57e98d9a5a72c8d7ad8fb7a6a58b3daf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689773179, "uuid": "ce1e2d03-1261-4822-a84b-723a72e8f439", "value": "3072:+NzPHk9MpcQbmKI3go4aJupcoCpYrl0UXavLU2iCF/C0SXnuiJt:+hRFmKI3geUTlLXaF6XnTJt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689773179, "uuid": "22d1c4fc-ef43-42b4-a67a-25f4076310bb", "value": 151286, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689773179, "uuid": "89992680-e767-4ab5-9fce-49c92501d263", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689773179, "uuid": "e4a5a40d-df4e-4c52-877c-d20098b5f309", "value": "DHL EXPRESS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0bea8ea-2630-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689770079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689770079, "uuid": "7079043e-6c3b-4ff7-9028-cdca786a2bc0", "comment": "Malware payload", "value": "5e9c1b607e02121aa326aac692805be2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689770079, "uuid": "7702b922-63f6-43b2-877f-cb599474c3ac", "comment": "Malware payload", "value": "a96b526ed74317d718298313e2c86854ec8e89b000f86577515e3e1d1cf61a3d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689770079, "uuid": "9204a333-3831-46cb-9c6c-f0f1ac3355da", "comment": "Malware payload", "value": "ed1ec5cfc6f6bf01cd43c4a8266dbfacc60194aa", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689770079, "uuid": "523f5cf7-2b5d-4ca3-9309-cb7443b56679", "comment": "Malware payload", "value": "b2761ab62dffab6a88b9b3f3659ccf19a240970524c7d6fa2cb62d57b0a84eeadc1533753dbeacc440622614889b42a3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689770079, "uuid": "13316b32-bf04-4f43-97ce-9cf08778d39d", "value": "T1B9337D05B390C0B3D5A7063969B89612067FBC629BF484933FAE024E5EB15D1BB3D367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689770079, "uuid": "fc193d4a-f7ea-4643-b7e7-aa8fb4a4c2d4", "value": "b3c5e81c2a49c8b00d13a96c67599538", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689770079, "uuid": "64c3bacc-6ec9-4787-aa44-352fc6611831", "value": "768:8e5x1wUkHdYwiV8VzvHrlNJwbY7ZTMqKvELXIfMWFNKgjistyxdjkTtBxPUskgK:8e5x+csbrJ8MJD7kTtBCskgK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689770079, "uuid": "2f23d48a-16c5-4535-bfd9-06fc9baad095", "value": 52736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689770079, "uuid": "1f5409aa-6a0d-4e35-b1be-9088688c6a8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689770079, "uuid": "2d31e295-1595-41ab-aa26-cf663693ad87", "value": "SecuriteInfo.com.Win32.PWSX-gen.15123.11642", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1c9e0d3-2629-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Hydra)", "timestamp": 1689767155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689767155, "uuid": "6f91ebad-2db5-4223-805b-dc34316763e5", "comment": "Malware payload (Hydra)", "value": "2d146be9bc321d0146ac567d1badd6ac", "object_relation": "md5", "Tag": [ { "name": "android_hydra", "colour": "#626579", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689767155, "uuid": "4260e521-9cb3-4b81-a2b9-0f133daa012d", "comment": "Malware payload (Hydra)", "value": "aa025721a546995e0068464372d803b1a627bf4b7825fb8f573913854f2e8c5a", "object_relation": "sha256", "Tag": [ { "name": "android_hydra", "colour": "#626579", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689767155, "uuid": "34e19b5f-90de-48e4-99a1-c512ebf5c190", "comment": "Malware payload (Hydra)", "value": "5fd9bd60345c14c51c1dd126cde6e19b7d4667ed", "object_relation": "sha1", "Tag": [ { "name": "android_hydra", "colour": "#626579", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689767155, "uuid": "f2362655-e403-4ddd-8a9e-6ea39166c27a", "comment": "Malware payload (Hydra)", "value": "2d1217e041938af0b8d07e44bbede9173f613caf216fba12cc437d17a9165827138edb26ea9a285526618c8ef01dc5b5", "object_relation": "sha3-384", "Tag": [ { "name": "android_hydra", "colour": "#626579", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689767155, "uuid": "f6a02999-0ffb-4328-a28c-eaf1618c169b", "value": "T10F163305B9689693FDE9AB305F67604657336FA0CF0AD228F91A732C15729E18F90337", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689767155, "uuid": "755371be-ab97-4ad9-a326-62b5e7562fe1", "value": "98304:rBZW9KUeuGp7zSf33kEjiS/GG3KnUZMtMr/spvDfpIOy:rBZJluGMx+S/GPUZkMrklaZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689767155, "uuid": "188906b7-fdd4-40cc-b260-61b82395a683", "value": 4181160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689767155, "uuid": "5dfe122b-d3d6-44ea-8e0e-e91f64a8ba0d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689767155, "uuid": "13a12fe4-4395-4122-9811-212b79ab2fe7", "value": "5fd9bd60345c14c51c1dd126cde6e19b7d4667ed.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d67d546-25e6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CoinMiner)", "timestamp": 1689738129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689738129, "uuid": "832ecde4-e154-4cf3-ab51-2657558af952", "comment": "Malware payload (CoinMiner)", "value": "0cfa847a9c818eeb70e5257a0e8bc770", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689738129, "uuid": "7dc1d478-bfa5-494a-bcc0-2088b7e84772", "comment": "Malware payload (CoinMiner)", "value": "aa1d20773de8de315982a585ca4f150a5d449dffa4c6e080f12ead32d594e0c6", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689738129, "uuid": "958dd4a5-3618-49e0-8ae7-3922dfacb543", "comment": "Malware payload (CoinMiner)", "value": "f390f4b958929428ef86a1e2fb7d73c2ac6f410c", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689738129, "uuid": "5cb77c75-5606-4c3e-a559-5ae288f4e384", "comment": "Malware payload (CoinMiner)", "value": "438ee21cfd7896bd7292d9a50d5740d3c8cbb5a0ec963cb97c32b4e9ac18993dd2158a01bc8581f2f892ace9ea4e62ad", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689738129, "uuid": "4be3da4c-7aec-4bf0-a85e-d467ea5297eb", "value": "T16D549343D2933D44E9268B769E1FC7EC760DF6508F8A7B6D6119AA1F00B12B2D1B3724", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689738129, "uuid": "de3480ec-1788-49ed-a6a7-1d85ad36b56e", "value": "41b4eb7c12331a5ff00a984ecb434d03", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689738129, "uuid": "07bebdd0-48ae-425e-a173-8b4a0eeae6c5", "value": "3072:c8BGpJ8ESLIKDYednKy+4DVBdRGMsjQ3IdDwYwLH5yBzFZCos:hG2LIKtDB1CIocYwcBz2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689738129, "uuid": "0b6594d3-b636-4550-a703-da7e1e0d4662", "value": 304640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689738129, "uuid": "411ffed0-ae5f-4bb9-8a9f-bd598d80d2b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689738129, "uuid": "a9401fa6-b420-453e-b1c1-756acb792028", "value": "rYE4LxBix0X64lTTIHAQW1Yi.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20672cfc-2633-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1689771152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771152, "uuid": "b4b10e2e-6e27-40d4-9cd2-5d41eb4f7521", "comment": "Malware payload (Formbook)", "value": "3397b57a42cb05a380177d2bab39a680", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771152, "uuid": "d5634308-74f8-4272-b848-a88aac6fe2d8", "comment": "Malware payload (Formbook)", "value": "aae4507b359991ebb7102b2531f939178db88102ac66b5307e5ea065d94639ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771152, "uuid": "f507744c-326b-49dc-9e02-87ebc63c7334", "comment": "Malware payload (Formbook)", "value": "5d552d40d6a90228e3f8b966fd692e95d260fb75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771152, "uuid": "6e77c182-08f3-4425-bb8b-5183db3da6fb", "comment": "Malware payload (Formbook)", "value": "e6d0ff91f5c975ce67f8f855f262b1099c2b060924f44b1515dc046be56e15662da458594f62f023db513f9ede9e0224", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771152, "uuid": "680170fc-1084-42b4-8de5-a8b74c78a3f3", "value": "T11E4412603970C16BE8625731277E0706AAB7D92659EC870F9B604E0DBC332D3DE2E756", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771152, "uuid": "905be270-2c06-4dd8-8f38-57c029497b89", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771152, "uuid": "d5cc75e6-9783-46f4-8926-0a1c26255119", "value": "6144:/Ya6Y7B0EzGGFHcJPm4G6uZhASdaVnFKJZ2LgENxgAx2:/YOb8+4G6YwRFKJ40gB0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689771152, "uuid": "33eeec6f-712f-4d3e-ad31-8af186a2e8a9", "value": 262153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689771152, "uuid": "e4e2d324-fa90-4502-8bbb-9785bdf389ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771152, "uuid": "e5c9f9fc-f96e-40a5-9c56-db7541ec0272", "value": "e-dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4863c47e-2659-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689787540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787540, "uuid": "24314150-46a7-4092-8f41-f5800a7a870d", "comment": "Malware payload (RedLineStealer)", "value": "8ff89a01b86bc69130e187d01d43e63c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787540, "uuid": "84c827fb-2544-43d7-9b5e-3436bb8edeb1", "comment": "Malware payload (RedLineStealer)", "value": "aaed3413b70440f5c77c6abc75ebe40d582d57d5d584594f5eaa3d0680c46212", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787540, "uuid": "fb6e3f3e-5da2-4538-9621-ddcd27c42bcf", "comment": "Malware payload (RedLineStealer)", "value": "fbd2adebc2cf3ff5ff128686ca41cf61421f185d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787540, "uuid": "67c49568-79ce-4c7d-a90c-6fb87ff3eda9", "comment": "Malware payload (RedLineStealer)", "value": "b06d151f4d9dc9b92bb5876f57cefe2d48d6cdad20696728ebde5788d4635188060c64549690aea224991ae50e6f6cc8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787540, "uuid": "b42029ae-3510-4b83-a468-b1de86073d07", "value": "T1AE840223FAE84433D9B417706CF207C31A36BDE59879932B3751A94A1DB2AD0A57133B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787540, "uuid": "50915a37-d097-47b4-8dcc-8967bfe7cd56", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787540, "uuid": "e6e1fb12-fdda-4a8a-8bc1-5a5eac1e89f1", "value": "6144:K4y+bnr+4p0yN90QE5N3YRYVo1Pd68GbW11IrE64hWyxKEg4zzNQKbve4eDL0:wMr0y90jo335+CEiH9es", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689787540, "uuid": "9935e9df-2596-4d4f-a4ee-5a6568a4e19d", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689787540, "uuid": "1b5dec13-e6d5-4b72-a511-7180c412d5d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787540, "uuid": "39559364-5b5a-4711-8258-d86415d5c409", "value": "8ff89a01b86bc69130e187d01d43e63c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac4953ab-25df-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stop)", "timestamp": 1689735309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689735309, "uuid": "6c31c707-7242-475c-b8b0-2f9b69b18bd0", "comment": "Malware payload (Stop)", "value": "5f5cdb27cc1bd6c97bd0cf99764123af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689735309, "uuid": "9cc17c3c-e685-492c-8d8d-715f8466444f", "comment": "Malware payload (Stop)", "value": "ab1ec5f4796115d92fb95f98e8b44bc6d4b0a25bee7484ff8ee2e64ba9ef45aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689735309, "uuid": "e323d48f-3b42-4d79-afdc-921acb568b14", "comment": "Malware payload (Stop)", "value": "a53236393e38994ac9300178ceae25b293572f46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689735309, "uuid": "7455d435-e73c-46d7-9751-fa1cb57967e4", "comment": "Malware payload (Stop)", "value": "ed0b2bafb5ef0ce559ecf549715e58954d4292c319f3284cd0ae3eaff4d9a855681ce98ae832d2ccfb873e8c7cb994ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689735309, "uuid": "2157bba4-2a04-422b-b62a-68058979d3e1", "value": "T12105AE4392E13D44E9258B7A9F1FC7FC770DF6508E8A3B696119AE1F08B11B2E1A3714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689735309, "uuid": "819ced98-243a-4d45-b9ee-fb16fc33993a", "value": "652881cb9702ba955ef807f9df82b24b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689735309, "uuid": "c213ebd2-efff-4cfe-a3c5-093dc00ef293", "value": "12288:4pl+4AfUrU/uae54f0IaaRvj2WKjni5mMkymH7/Pjxq4UhiuZCj+LtMZfi:hcGe+f0/aR6WwSxkVHTjUhiCCKWZf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689735309, "uuid": "f9314495-5556-4094-b847-9e54112b742e", "value": 831488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689735309, "uuid": "8484c6a9-2c27-4f2e-9432-00e410e022dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689735309, "uuid": "3609525f-1644-4605-9f7f-19f146c32a10", "value": "116B.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0614c2c4-265a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689787858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787858, "uuid": "eca774fb-6aab-421b-b8f3-9df38802eabb", "comment": "Malware payload (Amadey)", "value": "fb4b8d249123789e84971cbcb12c7d32", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787858, "uuid": "21cd8774-dc53-49b2-91be-d2b21f33ce1c", "comment": "Malware payload (Amadey)", "value": "ab228cf9d98b72e24dfea8f7abcf5f7d54ccf2e3098bb81e3f40b1672cfc0805", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787858, "uuid": "43d581e8-18c2-4a6b-8f32-8bab449cd446", "comment": "Malware payload (Amadey)", "value": "a8c1729ab15d8fbf6b9feac1448bec0551cd065b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787858, "uuid": "0f137a36-6906-48fd-993f-9487f8300668", "comment": "Malware payload (Amadey)", "value": "09da5f7366ec21a511714ac18f0cc978b8b79a6372c2ea0e0bd27b54d463398f5f3935d139da7f53253bc3542f7690f5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787858, "uuid": "7c15f3ae-3172-4341-a741-5809ed29fa65", "value": "T1C5B41282B7E46073D8F627704CF202D30A357DA1DDBC936B2B85589E4CB2A81A57177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787858, "uuid": "f1a925c4-3cdd-4d50-98ed-ed01f6a899b7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787858, "uuid": "13d468ac-80b5-49a9-bb66-f408033f1f8f", "value": "12288:dMrry90RhZSi8ho9hAZaUWnJyFGZnTwSPKJIDKWUGEGU:iy4hZSVaUiyF6vCJOGGEGU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689787858, "uuid": "1b9fe085-b2a1-4920-b25e-48533d5bcb39", "value": 527360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689787858, "uuid": "f42911ce-4bd3-4c32-b775-241e9e9e6e14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787858, "uuid": "15bbd834-0739-4d93-8e6e-672b4f0dab1a", "value": "fb4b8d249123789e84971cbcb12c7d32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03aa6dd6-25e5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RanumBot)", "timestamp": 1689737603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689737603, "uuid": "06f7a7f3-3f65-4e8e-8ca8-46eecf1041bf", "comment": "Malware payload (RanumBot)", "value": "1bf850b4d9587c1017a75a47680584c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "RanumBot", "colour": "#910B82", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689737603, "uuid": "9ccd80e4-31cd-4421-bab2-c3772923d49a", "comment": "Malware payload (RanumBot)", "value": "ac470c2fa05a67dd03cdc427e9957e661cd0ec7aecd9682ddb0b32c5cfc18955", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "RanumBot", "colour": "#910B82", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689737603, "uuid": "2fe8871d-9cc4-4a8a-a119-728bfc346414", "comment": "Malware payload (RanumBot)", "value": "75cd4738ffc07f203c3f3356bc946fdd0bcdbe19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "RanumBot", "colour": "#910B82", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689737603, "uuid": "bd794c70-8be8-4980-bf36-84cda9d93a11", "comment": "Malware payload (RanumBot)", "value": "1713b83a4a89c3d49a945706fdfd44790c2fb2a6ff964c7738614af87841cfd28175e812ed480748f94f0b2a98e7faf6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "RanumBot", "colour": "#910B82", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689737603, "uuid": "c17ceaa3-d441-44b3-8e54-d62af419e4c2", "value": "T10DA5334B779261D2C49AE277E1A01C82025DC1B2974EA951F714CBA58D3BA34F163FF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689737603, "uuid": "1507ed73-2284-46ed-9175-4e583ef76d93", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689737603, "uuid": "8d64cdfb-ec56-42ae-b5b3-9371e0e126a8", "value": "49152:UELEoxcmAny6Zh9DzmwJe/sKomVVE0zXlKSQjYU:lEoxcpnjPe/xJ7jQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689737603, "uuid": "8e4c31f5-4304-47e4-8851-38400968fff1", "value": 2130944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689737603, "uuid": "b38b660a-351d-42d5-abb9-450e6439e14b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689737603, "uuid": "661aa842-2847-4189-a0ac-57639df1985d", "value": "1bf850b4d9587c1017a75a47680584c4.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2daf8c6-2607-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1689752473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689752473, "uuid": "4fa95599-3576-40c1-a547-5477565073e0", "comment": "Malware payload (RemcosRAT)", "value": "da9534900ee0d11c9b30cf33152ea03c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689752473, "uuid": "22c5b303-7c1d-4d30-82df-f244ca1bcdbc", "comment": "Malware payload (RemcosRAT)", "value": "ac901bf5882f14e9e07235b8488b6479b4519addda6dbfb89147401c1e9e6e4f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689752473, "uuid": "9677ea15-5d1d-4b24-953e-45679cd27eae", "comment": "Malware payload (RemcosRAT)", "value": "1ad9e9761fd6935c0cf5048c9615d0383baac48e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689752473, "uuid": "f6b71bf7-5fd0-45cd-a3eb-a4eac6690746", "comment": "Malware payload (RemcosRAT)", "value": "09dde4c3886439038246b84b53da3aa1fc27ebce3f096698655612682f86abe8840da4c94eaa2eb4312831cf33bbb1bb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689752473, "uuid": "bd73f387-9033-42aa-9034-39fa90f4228a", "value": "T136E49C6F9DD06AAACD9089F4FD609474DFBD1C1B13C1D94CE8AA79CB793F8085242E12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689752473, "uuid": "7c0a2f88-3c4d-454e-a036-34767ade3fe0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689752473, "uuid": "93ff83a5-b324-4041-a2f0-68c3fbf506f9", "value": "12288:k8/HoptmKv8x10D+dHr73q/6pd7UB5k6d5EK7IS5SE/84a:1x1eML76ypZ/6d5bSIO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689752473, "uuid": "b441cc9e-4962-43af-b69e-4d0c4c0fd0e1", "value": 721920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689752473, "uuid": "c4a56eb4-95ca-440d-888f-7986d4792682", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689752473, "uuid": "e6a56c60-895d-4f72-a9bd-d69d3d4bde26", "value": "da9534900ee0d11c9b30cf33152ea03c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c74ae48-25e0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1689735578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689735578, "uuid": "d25dcb4a-792a-4c2b-b619-b1bfce29a46a", "comment": "Malware payload (ArkeiStealer)", "value": "536640e817facd71a4bfeebb18c16b06", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689735578, "uuid": "7cacff1c-6d09-4000-acb2-b105e2bd9380", "comment": "Malware payload (ArkeiStealer)", "value": "ad79e6cc3eed9f54ebf354168ba2328b25b0a9cb73e495488a53882d088c83ff", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689735578, "uuid": "758d264e-14b6-4d5b-b960-67e17c32c8e7", "comment": "Malware payload (ArkeiStealer)", "value": "9ad36d15ce9275ce30579619e4348a806195821c", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689735578, "uuid": "4c9916e1-6ef4-40d1-b89c-61fb573fa9df", "comment": "Malware payload (ArkeiStealer)", "value": "1ab2ab38aacbe3ae1130e80437b584f617f4b5817dce6a7b3f50ddf675ba14989c73e897a2ee0e682f4b201946aaba84", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689735578, "uuid": "15794874-f59c-4e42-9860-85b24c5284cd", "value": "T11CA401213AA094F4F56B1A344970C6A26EBFBC5357B151CF3788163E1D30BD16BBA392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689735578, "uuid": "aeb27b42-8114-4bf3-8361-ff3ff4c871c0", "value": "5f51bed634a396987c34d966ce5164f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689735578, "uuid": "2d021022-d23d-4b0c-9cf6-a8e720b6440e", "value": "12288:lL6GFnANffAzjxYEWHXP/YlT/HJ03O83:lpAtAzuXPM/pM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689735578, "uuid": "05c7b87a-02aa-4750-98e2-52381ddc3492", "value": 474112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689735578, "uuid": "937092de-cbcd-44b7-b1f1-bdfb943cff7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689735578, "uuid": "76d40d99-afa7-4b4b-8621-a1bea69aa3ee", "value": "tMGl.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db2f50f0-25f2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1689743548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689743548, "uuid": "f8f9a28b-5e44-4eb0-87ac-d8899b8458de", "comment": "Malware payload (DarkCloud)", "value": "70462b94519e8f0354cdde7584e536ce", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689743548, "uuid": "af42eda2-0df6-42af-9328-aef4dc05269e", "comment": "Malware payload (DarkCloud)", "value": "ad9af6543f3eda2c556ad005fc4f5b3b3b5298f54312d1fda5354534903f55af", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689743548, "uuid": "212034d0-94f2-49c3-8855-be20dfcdde00", "comment": "Malware payload (DarkCloud)", "value": "82216609abd57d9bb0b363d29c7456a7812b106e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689743548, "uuid": "90394986-33fe-4911-8fed-a09f03e93b51", "comment": "Malware payload (DarkCloud)", "value": "18b30cb8fb3139ee9c73b91fb5a1426d19fe143ab9d3c7a13fb400ef3bfbf50a19791e4443a8f9b562238f5e796cbbbc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689743548, "uuid": "08e8f07a-1357-4519-880d-e696011ed687", "value": "T16394231BF2F640FFEC4146726A7D17A786F652934860528F17C1A744BA361C6E90FB32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689743548, "uuid": "bf1895bc-b859-4315-9c86-b3b07d182099", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689743548, "uuid": "1af47189-c013-4a0b-a4a9-420979da33da", "value": "12288:/Y3DFejc4eN4rbwpN+Ftb4v3Gi2M/eXhjPC6cJ44MmSFJq:/Y3RwnbwpN6F4/gj1fe13Sq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689743548, "uuid": "2539edc8-5814-4a53-812c-f300375b8060", "value": 438616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689743548, "uuid": "c6be91ea-5b68-4811-a50b-84fd7dd581e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689743548, "uuid": "929c044e-2f0f-4827-b9a0-f8570e0d8a3d", "value": "70462b94519e8f0354cdde7584e536ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8fac306-2620-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689763221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689763221, "uuid": "26cc7c0a-d386-4138-8b04-50eb1a6c6eea", "comment": "Malware payload (RedLineStealer)", "value": "0f057b591f211c4151c638b568199177", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689763221, "uuid": "63d436a8-b863-4c27-b7a0-ee4dcdd5e001", "comment": "Malware payload (RedLineStealer)", "value": "ae35c73cc6c82d2797d6bde155513f78ec669243f5141054dc2cf0319651a619", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689763221, "uuid": "bed99b04-7eaf-4ae2-a068-6c98574e15ad", "comment": "Malware payload (RedLineStealer)", "value": "75c0624579815e8b760ff2ebd1f2998b06cebcdb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689763221, "uuid": "325d9933-9972-4d09-a435-4ee6a24ca48b", "comment": "Malware payload (RedLineStealer)", "value": "16e0102258db79acecf4b5f4dbbdcdbcda2a4a70e82a8ccbb098820b406b844dc96c3bac704383b869629b812b0d6484", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689763221, "uuid": "476e0c68-b710-45d6-9dd5-e344bbbba0e1", "value": "T11F840122E7E89033D8B52B7459F603D30B36BDA09E74866F2649999A0CF36C0E571377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689763221, "uuid": "6d76dbfd-0654-4d3a-8668-6f9306e680fd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689763221, "uuid": "b9e8b189-5f11-455b-8664-daab7f115c47", "value": "6144:Kry+bnr+xp0yN90QEPtLCbYy4la5CGBxiJ1Wy4zyRQdUqd/DfAMJzsV:xMrdy90/CbYy4lMkJ8y4zNNDfAysV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689763221, "uuid": "c1e2ab98-5bb1-4c6c-9cf3-2521f9121031", "value": 398336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689763221, "uuid": "89625656-8310-459f-b86e-381ecac33943", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689763221, "uuid": "d55eb75c-173f-44ba-a1bd-07561b36196f", "value": "0f057b591f211c4151c638b568199177.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c643a284-25fb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1689747378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747378, "uuid": "0d01e608-fb2a-4381-953f-2ee3c31a69bd", "comment": "Malware payload (DarkCloud)", "value": "f825697da8d31747696278747dc51ae7", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747378, "uuid": "c0d6f8eb-9ad3-46ee-91e9-d6eb0723b696", "comment": "Malware payload (DarkCloud)", "value": "b0ca90a4a10611f098fc18e528de4ad9f37c8272a525cd9fb44f8db874f25038", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747378, "uuid": "11e1d221-8bb2-4c40-a46a-7b770436071a", "comment": "Malware payload (DarkCloud)", "value": "d4f78f7e15c7dd72d5cc481b4eeb0df5b84f4d10", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747378, "uuid": "2f8e8cce-77de-457c-b256-d7cb97bd7698", "comment": "Malware payload (DarkCloud)", "value": "aaad83973e639c09316dfa2bf5efe541ceb148c5a9a6c582b25c5b7b5e814da7b00b46ef0abcc2226b99ca41ea4a4cec", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747378, "uuid": "18562451-e185-48d9-ad15-f8ae3ca67d10", "value": "T12D1522A8B3698967C8FE13F819B0630423B87E951127E65D9FC3ADC675673011B22F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747378, "uuid": "fec7b226-d8da-4b7e-834a-945a75a41afc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747378, "uuid": "fdc95c79-7fd3-4714-a1e9-0a6f393a5e2c", "value": "24576:gPYPgVG8e3uiYFmkKhukhszSR64JoftTLcv:gw+G8e+RhS9WzSR6nVa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689747378, "uuid": "3698ea1c-3bcc-4b26-8b96-fdad4625fd86", "value": 928768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689747378, "uuid": "00a16bce-a877-496f-9e7a-3c83fc39cb05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747378, "uuid": "cc630b65-c474-4bdc-98ba-ef1604b3d108", "value": "New Po.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "282eedba-25f9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1689746254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689746254, "uuid": "59c10361-83d7-4f24-a446-3285b63701bd", "comment": "Malware payload (AveMariaRAT)", "value": "dbd545d870bca84610165c95ce873b20", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689746254, "uuid": "9bd51cae-dca9-49f5-853f-4c03bc3b48ec", "comment": "Malware payload (AveMariaRAT)", "value": "b0dd13285cf9734d8f6ea7d4805375ed7cafa5acfc2f49d2eedb840f25ad6bb5", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689746254, "uuid": "79118a70-256b-47f1-b9af-6949c755ecad", "comment": "Malware payload (AveMariaRAT)", "value": "0c506fde50222858621e85aa1984026385fcec57", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689746254, "uuid": "0b318404-f818-4f2a-af5a-0bdafd9a0d59", "comment": "Malware payload (AveMariaRAT)", "value": "ef3bcb9eb7e86c3f6a973890a8c88b69c65d4d2d832609ae5e42100f5f2dc1ccb4ba303da15c1fb2bce8f473fcb646be", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689746254, "uuid": "bcf19da6-9b4c-4a4a-8d00-2e30b0a88f5f", "value": "T1F1F4E03036288F17E8BD53F99110555893FB6E5B212ED3588ED33CEB39B6F514A01A2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689746254, "uuid": "c76b70c2-3c2f-4c31-ab00-912d8dcff192", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689746254, "uuid": "328b1385-d025-4034-b7e5-6886c9752484", "value": "12288:Gf+AnT5HcW9RoTrfb/WT4UkuZhd/drdOXYq5ev2VY8RdQeeD1S91E51K8hJkXPQ9:GGedHcW9RoTrfzW/Zv/drucIY87kpSz9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689746254, "uuid": "855ec431-5b3d-4a11-9240-c960ea09a1f3", "value": 729088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689746254, "uuid": "b66049c9-aeac-41ba-92f4-e3de0786f42f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689746254, "uuid": "84efe33f-f3ff-46c6-91f6-0421db299586", "value": "SRV0193723882.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8099a325-2602-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689750268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689750268, "uuid": "d262832c-2239-40bb-95d9-c715f0121841", "comment": "Malware payload", "value": "21ab2479c94a479b06a73858ceb39c43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ticanews-com", "colour": "#FB8398", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689750268, "uuid": "5400daa0-447b-4f0f-852e-cd8aa9049ca5", "comment": "Malware payload", "value": "b0f0485a5f26d00a157c5e959abd8b5067165b0600ca44988ffe387cb0fcf539", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ticanews-com", "colour": "#FB8398", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689750268, "uuid": "1350428a-6aab-4aed-8c56-33de1789e89d", "comment": "Malware payload", "value": "b51df2e410b05711ee4a6e6eb77ae81e109cebab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ticanews-com", "colour": "#FB8398", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689750268, "uuid": "e4f22e30-3dab-4dad-a8ff-54c9d14cff8e", "comment": "Malware payload", "value": "852f39cd89c0914cc186df6b10e47d7865403c2fbfb0de488d8864c31109da0cc5f7f16530a38f935e44dfff967affc5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ticanews-com", "colour": "#FB8398", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689750268, "uuid": "2d737f6e-9c57-4e0d-8405-3a1c025db85b", "value": "T1A464DF06ABD900F3D4B78275C4F2598AFBB5F9501B3142DF0B24569E0FA3BD0AA39725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689750268, "uuid": "ccb5370c-5802-4f0b-b208-10c5a8670a0e", "value": "a884458d9480147b2d0b7b2497ef78f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689750268, "uuid": "180e06da-4adc-4b09-b073-818afeb4b381", "value": "6144:Ple3cQbr8vHnVW52wl3XAKblEajNHakU96Cjle3cQbr8WlUwecboR:FHV6ALap/U9Tole", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689750268, "uuid": "5e69cb6f-aea7-4399-bc9d-82d33b00f448", "value": 310272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689750268, "uuid": "e9a0470d-80b1-495e-9db9-1db20a9ef9d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689750268, "uuid": "c5618de5-0f84-49b7-a0ae-038b4ba4dc70", "value": "vcruntime140.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a76aae3d-25fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1689747756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747756, "uuid": "116910dc-8f4b-4cd9-8e6a-c3a3a5bd5ccf", "comment": "Malware payload (SnakeKeylogger)", "value": "d07c13653cbed4cca2fde350e264d7ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747756, "uuid": "f1d739cc-7770-4a0a-89df-aebc23cde7ee", "comment": "Malware payload (SnakeKeylogger)", "value": "b166f8281abdfa0539055969167c53f0d389af8bc8675a7455c1b74da2dddaa7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747756, "uuid": "9c560bb6-d41f-4a4a-bec2-2f6939eef023", "comment": "Malware payload (SnakeKeylogger)", "value": "7ad1d778bfe078670a651a0e9a9d662f2bf9a003", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747756, "uuid": "db383e9c-fc62-4fc1-a143-d80a08f593eb", "comment": "Malware payload (SnakeKeylogger)", "value": "d223d1eabe86fc6e8f9a64aa322ecb7277850579101a91f5b33a414f8eeac263a7554666e4b6e7493fbf78803031d8af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747756, "uuid": "350597ec-3622-4311-a5cd-0ea329b45719", "value": "T132D41240B7AACA17C0FD17F86B20AB0013797F866463EA0D5F97FCD934AA7104660B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747756, "uuid": "c39057e3-8cd3-45dc-89ab-7b1efd0cb8eb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747756, "uuid": "9ea1b1a6-182c-4901-aa88-bab326670a55", "value": "12288:jPYPfY7K+ArL4QGTqdRgePNd1MjlmA6wdNQRqHkUV3s5VFPE:jPYPgu+AP4mdPPP26XRykM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689747756, "uuid": "67f4b6ee-e572-41a4-9de9-c4b40bef4983", "value": 607232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689747756, "uuid": "a96231e4-c6f0-429d-8265-d7b9c8b784b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747756, "uuid": "a8557fa0-8d71-4c9b-97ac-1c07efbd6181", "value": "Profoma Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6fd6e56-2639-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689774035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689774035, "uuid": "98524c7a-380b-4667-aa04-ff9cd61f40b3", "comment": "Malware payload (RedLineStealer)", "value": "1df02e7a8bd92fc60d7803261f145a79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689774035, "uuid": "0bc2a541-2f9b-4eca-be0c-02bc94a15f0a", "comment": "Malware payload (RedLineStealer)", "value": "b22005984d343fd352d0b9067646db68950aebfa2c1e0d33b05276c602f98e40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689774035, "uuid": "65c587a5-da25-4c0a-a84d-9c353cc2345f", "comment": "Malware payload (RedLineStealer)", "value": "c39335bcc97c8ffce40bab53e10054d8f00beb7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689774035, "uuid": "adfe03e2-b107-4c95-9b32-a4435fe15596", "comment": "Malware payload (RedLineStealer)", "value": "f25b177343506598223892c989930eab46d850d29cfa2efee16ff86e1b36c9f2bff588b661c30c8d60f9a0aa53322bba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689774035, "uuid": "320a0626-1169-44b8-99e8-d331d29b9e70", "value": "T10B840213E7E84132D5B527B06CF713C31A36BDA09D78832B2B4A9A4A1C73990E53576F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689774035, "uuid": "ea32fb32-969e-40fb-8c70-a9d6cae86978", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689774035, "uuid": "37a36d35-2058-4b2e-b1d3-f265aca30505", "value": "6144:KSy+bnr+dp0yN90QEvcRplPxPItIu+sFW5YVtPgCrSJqO9bBHka:SMrRy90KRplZUwUkIa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689774035, "uuid": "92aaf34d-48d2-40fb-91d3-05b68404f0a5", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689774035, "uuid": "d2879a81-7b5f-4020-9952-f834ba98df85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689774035, "uuid": "093dedf3-79c6-41f2-9c1c-acd351235f2a", "value": "1df02e7a8bd92fc60d7803261f145a79.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc38ab7f-2624-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689765025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689765025, "uuid": "4269a9e6-f16c-4473-a1ca-dc14b0249841", "comment": "Malware payload (Amadey)", "value": "12f3bbee6e856924c7409555272d08f6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689765025, "uuid": "56c7e956-fdc4-46eb-be3b-57eddc9adfa9", "comment": "Malware payload (Amadey)", "value": "b2abc74f29ed52ec7d83d19dcdda578b75bfabfe3cb6be161acad9d570a9601f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689765025, "uuid": "b6b06c0f-11df-496b-b8ac-61457d60fdf8", "comment": "Malware payload (Amadey)", "value": "d3d1e4683056f11053fa888359ef50aa7bc3389c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689765025, "uuid": "1a2a3919-7154-46fd-b690-1e2b252a0dde", "comment": "Malware payload (Amadey)", "value": "ceedc4c0b3488fa0fc53f11dd55cc3b9798769ac99b68d28840cff549aba22863c671c005c9eaa65094a71ee2203db2a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689765025, "uuid": "182d8e8e-7047-418f-acf9-ec35c07f0706", "value": "T121840102FAE45073D9B507B40CF602830B36BEA16E78836B2B45685F5DB3695B93137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689765025, "uuid": "ff66592c-6931-4a01-aa7e-54ed4295377f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689765025, "uuid": "bbe7981a-ec5d-48d7-acb5-130854faea14", "value": "6144:Kty+bnr+Yp0yN90QE/qCUXAU08Nad122iFyAjm6FftxVY2xmT1fNPch1saI:/Mrgy90/mAKgT2jyAjLpC2xs9NPpb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689765025, "uuid": "0fde6ae8-31df-4f99-acfc-1fed445b8e39", "value": 398336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689765025, "uuid": "a31189bd-e0b5-4f91-913a-a72592821037", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689765025, "uuid": "914cfa06-ade9-4c9c-8c28-7b73eb797846", "value": "12f3bbee6e856924c7409555272d08f6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72847bbe-260c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689754539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689754539, "uuid": "c2b4a7a1-3634-4f46-b1b4-8054a4e6bc1c", "comment": "Malware payload (AgentTesla)", "value": "d772e045a1fcf2c381b0f18936f3a8e0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689754539, "uuid": "7c3f6f02-0cdc-458e-a51e-4dbcfad732d4", "comment": "Malware payload (AgentTesla)", "value": "b368be5510f752b95e68f8551d43c43f6024f4a71f8ce12c331f6a8d3980e667", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689754539, "uuid": "a2607abc-a0e5-45b1-844e-14b6fa146eeb", "comment": "Malware payload (AgentTesla)", "value": "0e26d02d2bbfdabddb87da07fe063ee4fdd4ef78", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689754539, "uuid": "001e1331-cbd8-4a62-92aa-a69f9058c5ac", "comment": "Malware payload (AgentTesla)", "value": "269667567ebbbc7291f45d3b232bf1840ae57910eda778967873b6c0c160ad1f073823b30038f96d4f9567cbdfdd43b0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689754539, "uuid": "181a8c97-54d1-4e6b-a14e-22b48fe1a7b4", "value": "T15CD423641B84CB37CD847BF44770A751A3F44FD8A819EB9D9FADEED1B8523600664223", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689754539, "uuid": "f7922ee1-015b-40e6-9ea2-e0e9792aed81", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689754539, "uuid": "3bced12b-672f-4a26-80d5-66d934833951", "value": "12288:vPYPfY7jBIiR++yEVrtPjHJ5oAEazUi/4oxlGSEHa5tW:vPYPghjsaBd5kazUU4oWSEHa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689754539, "uuid": "31e1222f-7fc8-4d97-9bfa-887e48796d62", "value": 638464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689754539, "uuid": "d5ed66a4-9423-494f-a035-ed65f22d7fa2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689754539, "uuid": "e549121a-f668-4665-aafb-a6c5556a2c56", "value": "pago transferencia.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc17d4d2-2652-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689784835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689784835, "uuid": "93858de0-79df-4b3a-9d93-cde1e830982e", "comment": "Malware payload (Amadey)", "value": "40c96c16c8166800c5db0515670accd7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689784835, "uuid": "3fc182c1-66a4-40ea-bd30-707d786f45ee", "comment": "Malware payload (Amadey)", "value": "b425d56ad7c143ee692a7bdd8e0fae7cc2bc1645796e74123a0f36067682b9b2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689784835, "uuid": "d82a7fd7-4a3e-4390-b040-8d0c74ffff50", "comment": "Malware payload (Amadey)", "value": "6659e66189576973577a9b6f508b394408a62ff7", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689784835, "uuid": "8a2860c7-d27a-43cb-9e0f-be874cf44e58", "comment": "Malware payload (Amadey)", "value": "f4540ed4becaa4482c9d31b4776c7ba009c63202f86c64b729455175f6c71e12b96cecb0892fd8197a1ef06eeeb30e12", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689784835, "uuid": "7afe9b4a-66b5-4df1-837c-5829a6ba6fa3", "value": "T1D6E2F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689784835, "uuid": "828c3dd1-99d8-4b56-b7b1-7bd060b9e92f", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689784835, "uuid": "96e80751-2b3d-4127-8b5b-87c9d8cc6fde", "value": 31287, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689784835, "uuid": "c7478499-0c28-4f2a-bb17-891f408a745b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689784835, "uuid": "3b1ca40f-1777-4438-9078-fd755d3141f0", "value": "40c96c16c8166800c5db0515670accd7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df9578bf-260f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1689756011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689756011, "uuid": "bcb4dd52-31e1-440a-a04b-a441f5047d10", "comment": "Malware payload (DarkCloud)", "value": "7a36be07a4959ceb55ff25e20423b5f1", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689756011, "uuid": "3b940fc6-2d97-4b91-9e58-0f1dc8b590c9", "comment": "Malware payload (DarkCloud)", "value": "b49944bb720e52f3f29bce89cda550a1ffaa4387849cbdc4a7be74f7e02a0aea", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689756011, "uuid": "88c94519-6f33-47ac-8e20-2f98b7c18069", "comment": "Malware payload (DarkCloud)", "value": "48976a331f343d878aa54dbd5e30f4f07918a4b6", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689756011, "uuid": "42a91df7-ea78-4516-a296-a9a8e0861cfc", "comment": "Malware payload (DarkCloud)", "value": "dfa261124b7f01dd6b653b78b287350052a895eb8c3f9e6f20cafa923be31e47efc21098b7c08aa314d252789a897ce4", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689756011, "uuid": "3d6193cb-6883-4be5-86d6-5966a9642e61", "value": "T1B3A4233DB6D9C077D9B144361F3E4B51E2B0B222A5AC2B1F3764291CB47AAD3DA0B710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689756011, "uuid": "3f4f5a54-ceb9-4637-accf-eab2b93be36e", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689756011, "uuid": "0c39feb1-b86a-414e-9d93-5e75bce6cdef", "value": "6144:PYa6B9MKuWWskSSSe1Ni1H0E/W9Q3KLlH/AIXrTSF1JuwJUA8IHs2woV4TAGUM7V:PYb9MLsk31FEe9/YIXC1JUb1FUMSHUF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689756011, "uuid": "51554649-df0d-4ad4-8507-cfd0e4d86cc3", "value": 451754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689756011, "uuid": "d3ee9971-9303-4631-983c-cbdf3844bd3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689756011, "uuid": "6959f671-0a05-45e1-aa7d-31814a013901", "value": "BL-SHIPPING DOCUMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ce2e58a-263c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689775173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689775173, "uuid": "444c3ac1-2311-42ce-90b3-2396330b9f03", "comment": "Malware payload (AgentTesla)", "value": "5e756bc5d404f987517b2684e209b219", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689775173, "uuid": "2c53eb85-986c-422b-abe1-3d64eeb107a5", "comment": "Malware payload (AgentTesla)", "value": "b554d95e0a2c20bd7d31a238e44cea99f0ced612b7fb2f4cc668f3f86217c011", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689775173, "uuid": "455bd85d-7be6-4c81-95ca-83d21a4c92c6", "comment": "Malware payload (AgentTesla)", "value": "0544494971e101ac22033748214aed7d353626c7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689775173, "uuid": "39929eca-447a-43d9-a4b6-9e9b799da296", "comment": "Malware payload (AgentTesla)", "value": "b0f529ea82ad910a57ef0128a7f9c3fe7dd95fed0b55dc8ee763dd5edb2a4518088a226d43e8f44336e00dbedbdd5aac", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689775173, "uuid": "9532d7cf-ea50-499b-9bc8-a9283f6bf301", "value": "T103D402C53A389913C6F442FA1612774443B4AA55F095DBCCAECBFCEAB0DA78D05C492B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689775173, "uuid": "d000117c-7eef-4b98-9f92-2b5785c93957", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689775173, "uuid": "dfd63644-57c3-4838-bd04-8e9c16ac6c19", "value": "12288:aKmYw+TMPYPfY7CywDvWshV1JFXfkxZ79aiBcADgi5Q:EPYPgJwrzFXfMZ7BcIgi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689775173, "uuid": "4e2c7169-a7ea-4f0f-af48-3f5a4ebd68de", "value": 647680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689775173, "uuid": "1d0f197a-23ec-48b0-994a-5f10ac4929fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689775173, "uuid": "e317793c-cb92-4b64-a56e-bdfa58d84997", "value": "5e756bc5d404f987517b2684e209b219", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63d6f7ab-262b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1689767829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689767829, "uuid": "3e27738c-30fe-4d90-94ed-c92a4524ae36", "comment": "Malware payload (DarkCloud)", "value": "2beb4f208d4706f75d280ed90db1fddd", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689767829, "uuid": "dc9d13ae-9dcd-41b3-aa81-4d6161758426", "comment": "Malware payload (DarkCloud)", "value": "b5ed694869ce7b707583fbd633e3ae3d1d9e5fb305d2da3204c9e99a1599812e", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689767829, "uuid": "62efa54c-910f-4e05-be67-c7b12fde2629", "comment": "Malware payload (DarkCloud)", "value": "e446e9e9e063d42b742ce3c850c8b760905c0b41", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689767829, "uuid": "c5e0ba99-75d8-4093-917e-ec62f93dfdc5", "comment": "Malware payload (DarkCloud)", "value": "62f26ef56932e450bacc81ae52917b5f04804192d8521557c94dacb4ce3b4de092efa0d58a6914b6d0d5ad5d4cf3634f", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689767829, "uuid": "8157549f-f4fd-4655-86ed-f1ca9b5b2a2c", "value": "T1426422086C3E0E92396063DA69E71B00725D7F1ADD55F0282B8567B0B3DB9872C79CF2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689767829, "uuid": "d3f0005e-085c-40e6-bb56-dbafa928887f", "value": "6144:MpU8PLmCMEjPv99EhpOnJHf8a/zuG/+H89IjtASl7mdPPYqSto0mo371mBytU:WPLqSPv99EhpOn19/g89xSodPPktWo3+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689767829, "uuid": "11b75295-68cb-40ed-98c3-25c741182aff", "value": 332618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689767829, "uuid": "e514fc6e-ac99-42a5-980d-666d6ad65b98", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689767829, "uuid": "a300fc5c-c7c5-4fef-9be5-3b3d89223155", "value": "payment copy.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e545f9c-2625-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689765323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689765323, "uuid": "a2d1f419-726b-415b-85a9-f7c14f4798b5", "comment": "Malware payload (Amadey)", "value": "5c749739580cbf6e833f47164b9b38bb", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689765323, "uuid": "eb4547e0-d089-46f1-a878-1b28cf6bd1ce", "comment": "Malware payload (Amadey)", "value": "b5edfa5b38c44d34c4a2a0f9a099e9155ccd08565aef09a91b1418a577eb1552", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689765323, "uuid": "a214b87e-ca5a-4036-b8b5-b3d1609749d9", "comment": "Malware payload (Amadey)", "value": "66299dbf33d927bca978c1dd1974a1cbe5fae56a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689765323, "uuid": "d409098c-1021-4710-ab88-bcd4621dc6b1", "comment": "Malware payload (Amadey)", "value": "308f02ac033b88bacd63d37fd872638d9a0df624e2e68c724cbd0d55ad4e2d13ebcaadd5ceec4eaf93097e683b6f2448", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689765323, "uuid": "046b7308-c2c7-4661-b56c-ba5ce5c4ffbf", "value": "T1C1B41242BBE89133DAB61B7068F303830B3DFC629D39875B26A55D5A0CB2691A135737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689765323, "uuid": "391905d5-12e9-4af8-888e-772b630f8e9c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689765323, "uuid": "b3746dea-0fa6-4199-af42-384b597dcd63", "value": "12288:BMrFy90xDhHNyFrWwqcQR1w1HC4gE3gCSH33dZXevl:MyEDhYZPYRmR3gN3tZuvl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689765323, "uuid": "a44ccd58-4536-4b00-b6d1-d6b700e598b6", "value": 527360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689765323, "uuid": "bd2a0ad9-255d-4763-ae80-34a59a3b6938", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689765323, "uuid": "a7349227-8fdc-413f-b48f-805cd0510ad8", "value": "5c749739580cbf6e833f47164b9b38bb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59e0514e-2632-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Vidar)", "timestamp": 1689770819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689770819, "uuid": "1f7360e6-22e7-4740-ac0c-3d82259a99c1", "comment": "Malware payload (Vidar)", "value": "d2192209d6892b9bf8e6d155a53b69a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689770819, "uuid": "ed75033e-ef59-47d9-b75f-b347ac5bfc1d", "comment": "Malware payload (Vidar)", "value": "b644ed105b1208ac7d25de367523aec04f53c18c68d7e389d892a0930cba860b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689770819, "uuid": "d1e7fa8f-3d7a-49da-9f63-769134f25b7f", "comment": "Malware payload (Vidar)", "value": "f417394441a253f7f0ef661b00905fa51c71b4fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689770819, "uuid": "11dca8b1-acbd-46c3-b51b-1cf1b329ac98", "comment": "Malware payload (Vidar)", "value": "560d271edaea7317235717c44e8d820c35df181aa3239a229c81786ef2e87ead0a44e38cc42eec1eeb54ff49e7ba29d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689770819, "uuid": "f313a376-1cb4-48d0-b04e-cb172ffcf81f", "value": "T187F5334D2C681E85FAF80EF88EF9813859201CD57448D76BBCADA5DF2F3A860F411D86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689770819, "uuid": "af9d9206-68af-4105-aa4f-83ea50b94094", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689770819, "uuid": "a3a7dd36-f44a-4bd2-8be8-e477d20618bc", "value": "49152:B9fBVAeoycp8DtPCrZPKh0wCqMEvhuwteJoltx6I+PGnGToq5aOCDDHV3:BnVAeh+8Dtqtyh5Iw4qZoGnZOCfHl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689770819, "uuid": "601fe42e-bf35-4aa1-9780-c4d5b9a2ed0e", "value": 3437696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689770819, "uuid": "94bfecd1-8f26-4316-8ba3-b9b66a347b29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689770819, "uuid": "ccd6ded8-3a4b-404e-b8e6-41481c6b33d9", "value": "d2192209d6892b9bf8e6d155a53b69a5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "154bb2fc-2614-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1689757819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689757819, "uuid": "f47e91d2-94ac-41fd-9804-d707a87670b8", "comment": "Malware payload (Loki)", "value": "4cb0f0394cd2fa1a0b4d65b49de36b63", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689757819, "uuid": "e28145b8-cd92-487f-8a1a-43062aee0b0c", "comment": "Malware payload (Loki)", "value": "b6522f4aa1002a1c75f0c2b16b53f6e948adee0a7fdd05eded6bed2d55235ad2", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689757819, "uuid": "935da637-1ddb-4fb9-b2d7-44086ef2fe86", "comment": "Malware payload (Loki)", "value": "095eb6c85d2618950e38571f3c1cfba4952783e7", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689757819, "uuid": "64e4ff36-a100-4ff2-9197-86f26bd8aa7d", "comment": "Malware payload (Loki)", "value": "307aa3894329e4c4042778f041a88a05ef289d8777f906c8e01f886cc447572e2d615f2e761252983b572f91c6045d36", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689757819, "uuid": "5a13cf47-36f1-4ef9-ad71-04bcaf274927", "value": "T127B423977902148123A999E8F395AADD87E04E76D08023EB8F655D20F672FF135B0F4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689757819, "uuid": "ae28a6ef-5c9c-4c7f-a37d-c0d3cd31a41a", "value": "12288:2XjbqQKTqPDZqBBr8T9G4+bhB6OPbEP6BnmUeTKcA4q8O:2iQKTqbgfYpC9BvPSELcAF8O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689757819, "uuid": "4bfa5adc-0580-4567-8f98-91ebeabbc34a", "value": 500821, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689757819, "uuid": "b7d45aeb-3037-4e0d-bca1-376423f961dc", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689757819, "uuid": "3dab9c2a-9d68-4878-a71e-a35aca95f380", "value": "Shipment Document BL,INV and packing list.jpg.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7877af22-25e0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689735651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689735651, "uuid": "462aecba-d3c7-478b-b68e-25bc7cb3d156", "comment": "Malware payload (Amadey)", "value": "2180205f8ead587dd56762145e7f784f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689735651, "uuid": "6615badd-b8ab-423b-9ca6-8b7aa9006af5", "comment": "Malware payload (Amadey)", "value": "b813f799e9c2f3b9ed25625bea968e14cbcad8bb1b3918ebcd79f631192ca017", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689735651, "uuid": "869a4c65-5089-4704-afb1-88c0d505a9f9", "comment": "Malware payload (Amadey)", "value": "401ccddf09243f26c09e7c8b2d8bb49552835010", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689735651, "uuid": "c1f781c4-37a3-46dc-9275-518d26d72517", "comment": "Malware payload (Amadey)", "value": "1afdfbb9bf4601011222c782ba998cd80680bce92c7faad60b73acf7cadf3112624d6378385377e0071462968141a606", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689735651, "uuid": "11828669-fec4-4b1f-a899-ae18f4fac6f0", "value": "T1EC34E113EBE89032D8B9177048F603C31B367CA1AD78836B2785995A1DB3684F97573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689735651, "uuid": "3c6bd7eb-59c1-4df5-b5b5-c9ce564a1adf", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689735651, "uuid": "dc80f9de-e5ef-4bea-9b90-262d0ab05e02", "value": "6144:KOy+bnr+Vp0yN90QEchQmyJXNcrGFySYCcHnlRHw7:aMrBy90mC+rGYYcHnl90", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689735651, "uuid": "9a24568f-4eb1-4f45-bab1-100e812989be", "value": 240640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689735651, "uuid": "bffc93f4-f449-440f-a4c0-713a25f3bda3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689735651, "uuid": "02cde29e-6e14-4104-9c67-2d2df90fd6b8", "value": "y0520696.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e446020b-260f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689756019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689756019, "uuid": "196470a4-2e24-4e18-a0f0-fbb05c871527", "comment": "Malware payload (RedLineStealer)", "value": "29ab96aab2936a83493071d8bbd1152b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689756019, "uuid": "bf50bda9-f150-4a07-ba88-faf1023a34dd", "comment": "Malware payload (RedLineStealer)", "value": "b8a047e3cd4389b70d5328f8828567ecfd7d308aaa8023f27d2eae441c8b2c05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689756019, "uuid": "34abcf52-5762-419c-ae43-642b1f43b6d8", "comment": "Malware payload (RedLineStealer)", "value": "c0ffbc52934f45ac5de2af1bc545a11f3d961713", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689756019, "uuid": "eebb058e-9053-4e83-974f-792772338a8d", "comment": "Malware payload (RedLineStealer)", "value": "e3c5ac9b5c33b039b2841953a5ab604a755ac7db67e249df4c3d3133b3c12fd42c32ffd2b7493d30cc23cc9f839827b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689756019, "uuid": "c9985784-501d-43b5-a315-9660adf18f92", "value": "T1FE050221B6C580B2E8A65C350EE1A375BB7C7D3107354FCBAB800A5D9F605C19B35BAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689756019, "uuid": "d4dbd98c-9b20-40da-85a6-ffa856cc411c", "value": "fa8d20faea9ef7b4e2b7fbfe93442593", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689756019, "uuid": "8113a7b4-6e6e-4f20-aa7c-e0f74162768d", "value": "12288:f3DkEGDINi1EwkG8/sHWihcD8hwbL8tN2cEFLjGPSciSYoIjYtl0xzyuxHHmC5:/DkUNi1EvGVWD8u8EGac3YoIxpV5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689756019, "uuid": "b3d846aa-0300-4c9d-afb1-97001e044942", "value": 849106, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689756019, "uuid": "7a9acd41-faf8-41ed-9dc0-5932e7ebf5d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689756019, "uuid": "89036907-5d87-4d6b-89a5-812e07d3db85", "value": "NEW ORDER SAMPLE LITS.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2579cf71-2639-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689773737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689773737, "uuid": "9113be8a-3173-4285-92fb-103077db74e0", "comment": "Malware payload (Amadey)", "value": "59c9b460225451cbb1e45e47c334d898", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689773737, "uuid": "2038971c-97e7-4589-ab85-c0a1fc174fba", "comment": "Malware payload (Amadey)", "value": "b8d6d40ceb8eb4629f70f1a83e6e09e52da0cfffaf3354a4bdd9dcef75240adc", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689773737, "uuid": "fa815af0-7439-49a6-91e9-ce2f2c75dafc", "comment": "Malware payload (Amadey)", "value": "54a8b11936bac1643aa7f06ef981198841b2456c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689773737, "uuid": "c4e2c5f0-8dd9-4f67-8c21-d85391b5c7a9", "comment": "Malware payload (Amadey)", "value": "f19f20af9367c60ff1165f0f15d591523a77a5b0dff10ed6b04487fc4b49a4629638f031b34eff523ea7ce2fadac3764", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689773737, "uuid": "17c10813-7431-401b-9d51-ac8bbc774d4c", "value": "T115840252EAD88032D9B527B05CFB03C32B32BCD09D39876B7785A89E1C72684653577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689773737, "uuid": "29309f9b-76bb-4fcd-aa85-c28d5c2e06a0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689773737, "uuid": "6174f64b-fc1e-47a8-a306-c484e385408d", "value": "12288:UMrky902VVmcIyVW9JeVis3VQCrrnEpM:AytVlVGJeVisypM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689773737, "uuid": "03c465c0-a26e-40b8-b3a3-560e66bca4de", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689773737, "uuid": "7452227b-d59a-41c4-a057-edffd37c6e54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689773737, "uuid": "ce5ff217-7b58-4fa4-8cb5-4d66bf8a9ab9", "value": "b8d6d40ceb8eb4629f70f1a83e6e09e52da0cfffaf335.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df3281c5-2632-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689771042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771042, "uuid": "99b1f20e-a321-4a3e-81e3-571af06cf67e", "comment": "Malware payload (AgentTesla)", "value": "1d99ea58855f95b27262f040b84e14c3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771042, "uuid": "e9fdb378-0c25-47aa-ac57-077992562462", "comment": "Malware payload (AgentTesla)", "value": "b977212d9ffc64347bc89699c77534009c2c4b057542a995d2e104ebe46f6012", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771042, "uuid": "a51ec0d6-1689-4ac1-a79e-482592e33470", "comment": "Malware payload (AgentTesla)", "value": "abf835869116015501cc683c1c1c328dc41d7a71", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771042, "uuid": "eaf46f09-9f49-4b03-8d64-baa2f761a53a", "comment": "Malware payload (AgentTesla)", "value": "8be20954cc1a401213df288981f527e0a8a00d823c8aae6d1fec967b3dd0fc6e585f4be6ba734d7482f7706c9b2c73c9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771042, "uuid": "798e78e7-c83c-40c7-8195-bc6c515d668d", "value": "T10603065AE79F02698F911273271B1E89AABDB23DB35054B1385C833433EDC7D42666BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771042, "uuid": "71d9f27b-d81a-40f0-b122-35e1409669c4", "value": "768:+Fx0XaIsnPRIa4fwJMte+Csp54M4r9XRob1ycDjLp1Qyqp:+f0Xvx3EME+gM4rRaZyc78yqp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689771042, "uuid": "308e8492-f302-4508-bf99-c5823ec8d0db", "value": 37824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689771042, "uuid": "466330da-24d0-4ce4-b346-37f1f571e032", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771042, "uuid": "a5111578-4546-47ec-8a40-f87f083f0fa8", "value": "RFQ.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3deefbeb-25f8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1689745861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689745861, "uuid": "83310176-d328-4f36-ae9f-ea4995ab2f13", "comment": "Malware payload (Formbook)", "value": "3b5c0d9ff045e096157575a2addf48c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689745861, "uuid": "30847d22-ce47-4013-b1c0-c39495794793", "comment": "Malware payload (Formbook)", "value": "b9cf0848d2bba746fab74aae513f2b9815a1bb134e198e99c12d280568b1210a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689745861, "uuid": "a9960abe-f0fa-4ab3-9f18-39d64571c049", "comment": "Malware payload (Formbook)", "value": "b3f68c7c5a336d1d43333bede3f9ab8eba1e80a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689745861, "uuid": "03846ce5-e624-4b01-b349-7fc6bb48608f", "comment": "Malware payload (Formbook)", "value": "9d2e57ae625f2fb462e7202d0b42698f809beb3e1945c5547fd7245720f12c0ad85d1aaa7d95f71d02480634908d8bac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689745861, "uuid": "6c4ad1b1-8a7d-4c7c-83c2-64973cb16d4b", "value": "T182541208A6E4C4ABF0A30E711E7F565F6EF766191EF0821B13707F0438B2A91591EB76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689745861, "uuid": "e096998f-54c1-42dd-9190-03f5f53cfe6f", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689745861, "uuid": "07d724ed-d8a7-4ab8-8778-de65e4ccbf0f", "value": "6144:/Ya6FFP+PPEew91b1mrrFTqRYsn9OuGDBGt7y+T1r1LDFNU:/YXIPMeW4rFTGYs9OuA4t1xr13FNU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689745861, "uuid": "85f6e42e-2563-4209-b835-f6e542f215a5", "value": 279364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689745861, "uuid": "77b97355-a4e8-4a6d-b3c2-5054a6e65fad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689745861, "uuid": "1ac48961-6f2e-4372-9c38-bf99884e9fe7", "value": "payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bd83a21-25d3-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689730047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689730047, "uuid": "a46beec1-10f4-4c22-9ac9-2524ec1dc62e", "comment": "Malware payload", "value": "6d19fac422760ce70367b05c1af1ef18", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689730047, "uuid": "7890a00b-68fd-459a-b43b-1fd2ae08a185", "comment": "Malware payload", "value": "b9d9f69f11917cf534a9694e7f0d535cf158391fffcdf0d9d6e1307cd75bed05", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689730047, "uuid": "adbd2151-9f6d-4016-907f-4bbad6848188", "comment": "Malware payload", "value": "6b2e2843b89e50da233d4bec564d8afcca9242f4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689730047, "uuid": "c0078996-9274-46f0-ab5c-00c25c28acdf", "comment": "Malware payload", "value": "d0d019d581e679ab64fcb90138e2c3a3463081155073bafde6bd2419a766dbf757ec9872e15e906286ac3824a6f418ca", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689730047, "uuid": "0bf089d0-dc3b-4367-98f2-8c50a9e7f327", "value": "T141337D017AA0C0B7D9A7033419AD96214A7FBC629BF4C4833FAA160D4EF15D07A3D397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689730047, "uuid": "9f4437fa-0cac-49f0-bc74-41dc59e1a7bd", "value": "90c2b41dbc64bf3f152f09646916224d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689730047, "uuid": "67098427-0211-4460-b205-29d0ec71b504", "value": "768:eDY3B4bKTwdUT2P43tbY1UEFhWANKnXs4yxdjhTtVQ98lRzOcRqTYiLg:eDYRKGy43yeXs7hTtea", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689730047, "uuid": "eb581193-b2e1-4093-b3e1-b2dfe605a457", "value": 53760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689730047, "uuid": "3a3565aa-fd2c-4be1-84f8-c486ee3b3260", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689730047, "uuid": "b7211f78-02de-4876-8a9a-f721500d55cc", "value": "SecuriteInfo.com.Win32.TrojanX-gen.16195.9012", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba51e6e8-2641-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689777423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689777423, "uuid": "8e3f2428-a231-4ac0-b6f2-112766690485", "comment": "Malware payload (AgentTesla)", "value": "982a4508a9946b811ed5fdb1775f2db2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689777423, "uuid": "67df946b-959e-48d2-880b-bac8a5ef0cfa", "comment": "Malware payload (AgentTesla)", "value": "ba7f9aa187f2834a0e730911db8e70b035a93c5bfd1d98306a1b8841ee63d9a8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689777423, "uuid": "d9c68a3f-fe4f-410f-af99-2c23b776186f", "comment": "Malware payload (AgentTesla)", "value": "5bd6a1bc56a47d8994c44dbbfb4c44deea5587ca", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689777423, "uuid": "ea9f83cd-5c05-49d8-a842-d37ef0459b4d", "comment": "Malware payload (AgentTesla)", "value": "2a0822601c3c52dc9fb8bd0b60173f68a1083f3989e103bf7790f290581c937c74923630661a63fc48d958ac3ebf1a72", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689777423, "uuid": "3fcbe5e4-424f-4685-b084-095f9c087d4f", "value": "T141D4120129A48B66C6A4CBF91614A71463F6CFE93461F02D5EDBFCCB71B6F101A90E4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689777423, "uuid": "1ab4e80e-3d20-4f33-b00c-11a0a02bce05", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689777423, "uuid": "12abe60d-95b9-4012-90cb-9a1d94125198", "value": "12288:ROPYPfY7P9MNfLO29BiS6bbfoMc/AMOVapaO2ChlZKU7:YPYPgpSnT56HfI2Ol", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689777423, "uuid": "ed251831-6fc9-43e6-bad7-34ffa9ec20c7", "value": 650752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689777423, "uuid": "e31c91ee-d014-4c8b-a855-83e8deb10f2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689777423, "uuid": "af530ed5-e1e4-44f7-9e81-5f854256a262", "value": "Fiyat teklifi Istegi_2307130_PER 1000 Adet \u2026scanneed 00101.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31313d50-25e6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689738109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689738109, "uuid": "686b3f82-aeb7-46cc-9055-23ec4e5d3f35", "comment": "Malware payload (Amadey)", "value": "8c6eecc41477c4cf4748f58538c2642e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689738109, "uuid": "ffb179db-cc86-4736-8128-0341ac73e00b", "comment": "Malware payload (Amadey)", "value": "bbdee10572b5b793b928720c52c95009fece8e14d1d6cd60f528fab8871a7262", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689738109, "uuid": "46721bab-78aa-42c6-9335-c5c0b6de4a8a", "comment": "Malware payload (Amadey)", "value": "73c84585f4e45933e560d010eba1010c667c736c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689738109, "uuid": "3cae9ea7-1a10-4b56-bb2f-0733024f8332", "comment": "Malware payload (Amadey)", "value": "071526e2a25e13a443a9f4859b129514434ea0dffc57bc7198447c7c1697dc3ee14304610f3f283349ef2c83d56502b6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689738109, "uuid": "f575f749-b160-4af8-a1ab-678250ac4bba", "value": "T16B740213BBD99036DDB41B7069F707C31B36BCA29DB8922F1785688A1C72584B53173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689738109, "uuid": "78cb703a-639a-456f-8bec-2bee52d029ba", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689738109, "uuid": "d5523354-d239-4490-a40f-186c9202d689", "value": "6144:Kfy+bnr+zp0yN90QE7v0h4OWh5akk7eWEQKYzIGtqZeHn8oZUl8H2g1VBw:VMrTy90SiOWh5akk3KYzmZCsl8f1VO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689738109, "uuid": "cc265e67-ab58-4bee-b678-a3db94769923", "value": 368128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689738109, "uuid": "8361e339-3b9d-4022-a632-c2cad1d8bddd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689738109, "uuid": "44c601ee-8c9b-4a94-839f-9bef45fbc4f9", "value": "v6638425.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48fe80cc-2611-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1689756617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689756617, "uuid": "9acba986-15ce-4e17-9cb4-edb21c6a2448", "comment": "Malware payload (DCRat)", "value": "be60d8d49e9890d487437534c8705095", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689756617, "uuid": "ec381f6d-9e8e-448f-98e8-9de95555dab1", "comment": "Malware payload (DCRat)", "value": "bc76c486fd4cb088e781642091e9b233e52b7964a8f2c16ad15b0cc63bec9775", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689756617, "uuid": "e36069c3-4200-4c4f-898a-6fe20abe1158", "comment": "Malware payload (DCRat)", "value": "130e15c144dffe465b40e2bcf6a2b4276c3d4fd7", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689756617, "uuid": "19b99bea-32ba-4e1f-a509-c4325189e48e", "comment": "Malware payload (DCRat)", "value": "3a8186fb6cbf2339aa4ea7d1bf908fa58c722e707631d18a312ab9fb08efd9ac09d72aa3d05361a0a4b1788db5790df5", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689756617, "uuid": "4b1df57d-8f40-4243-bf6e-74ecf034d647", "value": "T1C05539127AC6DD02D0291637C9EF942847B9FD027B62C71B7F9A3B5C65263A30D0D6CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689756617, "uuid": "4aa80a44-25e6-46e7-812c-ae23b0a815ea", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689756617, "uuid": "5bf1d9b1-b46a-4f6a-aa53-e4bdac5f8f1c", "value": "24576:H2G/nvxW3WW0SQs49Wyj+IHJFycVtCucN0eEtOzW+4K:HbA3eSQs4Xj+RbN0iX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689756617, "uuid": "08d41c11-2198-4874-88e8-4d12cbab4fdc", "value": 1391315, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689756617, "uuid": "f1cac8db-3d9f-46bc-bcaf-478bde6fbb60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689756617, "uuid": "27acb907-fdc5-40b1-a5d4-28bfbefcadd7", "value": "HEUR-Trojan-Spy.MSIL.Stealer.gen-bc76c486fd4c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5f77047-2635-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689772235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689772235, "uuid": "5c38489c-4dd7-4744-b63e-bc245e33506b", "comment": "Malware payload (RedLineStealer)", "value": "3a4cea3fc66e9b3d9560878ba1663cd9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689772235, "uuid": "69ac6a53-b950-43b0-8b82-c0e142507011", "comment": "Malware payload (RedLineStealer)", "value": "bd06bfc2696394e32e12dc7d9c3585842b78bfbdc24f4157679058145abb22a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689772235, "uuid": "4ebab9e1-0384-4c83-8f2d-9d0ad388bafa", "comment": "Malware payload (RedLineStealer)", "value": "591d5bef008232bbf43c90708e23f8d8e4eb2f22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689772235, "uuid": "96962723-6f93-4820-b4fe-f96eb5669340", "comment": "Malware payload (RedLineStealer)", "value": "57e718556e40d350d9bc7ea750d05f79ebb449c5f5fd909aeac612c3c0bdf7236a0d48b66124db786737f24d0961b84c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689772235, "uuid": "56d9db81-7642-4fe7-8867-28084cb7a177", "value": "T169840212A6E88132D9F12B7018F216C30E39BCA19E7D83BF63865C1D4DB3595E571B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689772235, "uuid": "c2847e67-a25e-4e54-a16a-2310332a50ff", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689772235, "uuid": "b89438ae-ae5f-4dc4-b4db-d6ec9346fede", "value": "12288:HMrCy90LK3WNWBSPa46LcHnl9nZF4rQKL:hywyYzHNF4TL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689772235, "uuid": "6bda8353-7fa3-4d9d-866e-1375b83d51a4", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689772235, "uuid": "e04268b2-63cf-4535-8985-37f75d06c61d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689772235, "uuid": "be4fa754-b493-4184-81f7-df598cc4acdf", "value": "3a4cea3fc66e9b3d9560878ba1663cd9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "374f128c-2632-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1689770761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689770761, "uuid": "584a136d-9024-46fd-9749-bc41edfc28f4", "comment": "Malware payload (SnakeKeylogger)", "value": "71a6978a9fa2085234b08af213a85394", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689770761, "uuid": "648ce837-4fbd-4041-9dd0-e995b584cea4", "comment": "Malware payload (SnakeKeylogger)", "value": "bd7340bfb3d38cb418bb4c539f63898ea6b7e69823c808665620844313c21ddf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689770761, "uuid": "918b9186-8359-4259-be7f-de04fc906462", "comment": "Malware payload (SnakeKeylogger)", "value": "387997a190c9b12787827903d8b552f4c2448c4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689770761, "uuid": "8c6405dd-ebb8-4224-b845-84551f20e65b", "comment": "Malware payload (SnakeKeylogger)", "value": "a09d250f519375044af4fd46a35b1a320d8943adc396979579962fe994c6757a008ca74e425e88864d5d337dfba393e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689770761, "uuid": "455dccc8-2325-465b-88c2-64e5c17bcb78", "value": "T11FD412116AA48B22C6B4C7F847A4534567F99FDC2461F1AE8EA7EDD371B2F100A40F1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689770761, "uuid": "2b46ba7f-4876-4668-94f4-ece4484c65fd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689770761, "uuid": "3cc64cd5-2c8c-4123-838b-0ce9027d8484", "value": "6144:9SnVudiQAPAjPP+iY7JIwd8rTc9BtUYzitmVAWzR4+/7HysCrCFX3mS1B6jKPjp5:eTPYPfY7Hd8rw0wms/0jq8r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689770761, "uuid": "70bf50d7-b441-4924-a276-82ea5c9b88cb", "value": 604672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689770761, "uuid": "c71a01c2-210b-488a-b273-1c81b2cb1fc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689770761, "uuid": "56495c47-aa31-4bbe-b15b-61c6db2efb3e", "value": "Profoma Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f7e315a-262d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689768627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689768627, "uuid": "f6d0ff2b-b02d-4851-99e4-d753c0a5fab7", "comment": "Malware payload (RedLineStealer)", "value": "d379da52bb339331c8774c094dcf6f37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689768627, "uuid": "78b21632-e59b-4c5d-922b-618316d93b92", "comment": "Malware payload (RedLineStealer)", "value": "bdf4f3c5b8e590124125b69331d3e77fe084d7d11088ec5225114f8e6f0becdd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689768627, "uuid": "60b61333-dfad-4dab-91e7-16097f78abbd", "comment": "Malware payload (RedLineStealer)", "value": "741f051efda48c49b2b4a9d1a7dbc6d6ebe33334", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689768627, "uuid": "3130be79-604d-4fc9-bca3-2f3efae66ecd", "comment": "Malware payload (RedLineStealer)", "value": "36837ea71f35737b06975ce9f7134698c15472cb155d0a41cd09eb0bccc10a629305552631a04abe63780a620455dc28", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689768627, "uuid": "c29bc16f-fe1e-4b36-a99e-3da672a98239", "value": "T130B412429BD88173D8F117B084F616970B3ABDF0593C936B2792AC9E0DB25D0793277A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689768627, "uuid": "4210e6c5-fc01-4f03-962c-1385d56ca77b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689768627, "uuid": "edcb3b64-2d3b-4451-9d6a-15bebc087dc1", "value": "12288:AMr5y90IHvBRFfRoKLuhcy7l6bwIYnvai+yjmt1HBqHsXvf9e:py1PzBR+cyp6UIEK75BqMXvf8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689768627, "uuid": "b8ec3975-f07d-42ca-8668-21018481866e", "value": 526848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689768627, "uuid": "117bc804-af98-4293-bd7c-7922df65c410", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689768627, "uuid": "5b3e7d09-b63c-41a2-87b9-f7731404f7a8", "value": "d379da52bb339331c8774c094dcf6f37.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16beb085-25fe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Meterpreter)", "timestamp": 1689748372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748372, "uuid": "1a8592dd-f16e-4806-b18d-58b05a5174e8", "comment": "Malware payload (Meterpreter)", "value": "b6d22463ea92d6119b509f7855072625", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748372, "uuid": "e8e5c000-95cf-44fd-b94f-8d9104608011", "comment": "Malware payload (Meterpreter)", "value": "bea44c7dfdb6207426967d631883c5b575c67a4d6d78cedb92094e315b42b5f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748372, "uuid": "3f3d9395-feaf-4921-977a-bec75fe114c0", "comment": "Malware payload (Meterpreter)", "value": "edfce2b28e415779e05caac591678a1f6e1b5d55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748372, "uuid": "db7b58bf-b898-4044-afd4-f12a8a7e6c84", "comment": "Malware payload (Meterpreter)", "value": "ffc99c2c68854e73217fcae81471d382683e72e5ac89ca8ba3a35d5301379bcd729899971053be64ea4d903c66a9c8de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748372, "uuid": "9d7a882c-bacf-4f2f-ae56-d672e981dd24", "value": "T13273BF41E9C41572C2A6127D67303AB5A975F5FA7342C19B3A8CCDE5CBD0CB0A7263CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748372, "uuid": "56949827-5d91-4f7f-9745-fe8023e886cd", "value": "481f47bbb2c9c21e108d65f52b04c448", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748372, "uuid": "148e5fc3-66bc-4ffc-a0ee-6e290cb3a5bc", "value": "1536:IXs8vQGk6eeCQCRNf8Mb+KR0Nc8QsJq39:osds82e0Nc8QsC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689748372, "uuid": "ef75454a-4802-4bb8-a5f3-9e6e5fd9a5b8", "value": 73802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689748372, "uuid": "7d1fa34d-9eed-42be-a4bc-704b79112893", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748372, "uuid": "e37b8130-ba05-482d-9385-d76055b10080", "value": "b6d22463ea92d6119b509f7855072625.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26021736-2633-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689771161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771161, "uuid": "c44caa26-9ebf-4d90-a2a7-f56c6f6908ca", "comment": "Malware payload (AgentTesla)", "value": "57e694a52de27003592f90cd4ac6a364", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771161, "uuid": "da7e67fd-d6b2-4f86-acfe-3fee9c6d8144", "comment": "Malware payload (AgentTesla)", "value": "bf4eb25b59a0472448b5efed8a8b5286867ffcc99751f2aee8c2b5e208800b7b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771161, "uuid": "5767940b-e85c-4c49-9f17-6aa3019bc7d8", "comment": "Malware payload (AgentTesla)", "value": "7464b77a158e839fd190fbe1f64ba4675a61a6f6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771161, "uuid": "46631d58-5a9c-4a89-87aa-e0603e43c618", "comment": "Malware payload (AgentTesla)", "value": "f86b94806f32320b5dba36a3640bc97bd03bd58df8915f5a4f5b401a71a7172349788e50186546ccb4d0e9eee7668d45", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771161, "uuid": "76bbb649-b746-44a6-8366-5d4d92f5a76e", "value": "T129D4120169A59712C0B487F44664A70513FAAFD83471F22EEEEEECCBB166F581A40E17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771161, "uuid": "39dc82a9-9e93-411f-b48b-2aed746b4a6e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771161, "uuid": "31aa546d-1ec5-4f92-a325-32f3d648d58d", "value": "12288:UpPYPfY7sstIief6WCnAh/O1CDmcoZCH1hCC7MP3ocFq/lwoOjsU:wPYPgp2bf6HnA0IDmcoMT77efU/2oO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689771161, "uuid": "38f27886-38cb-4706-9a3f-4666a6071964", "value": 644608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689771161, "uuid": "609adf4d-1327-4e76-84ef-55ac727aed16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771161, "uuid": "ef5f7634-4628-43c9-8518-0b70c4de50cd", "value": "e-dekont_html.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc24028c-2615-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1689758528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689758528, "uuid": "118d29df-90b0-49a5-a425-4162bee2d27d", "comment": "Malware payload (Formbook)", "value": "7f799d603b27313c03eb08b1137a9d8c", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689758528, "uuid": "1a992d3d-1c37-46fe-a148-9754177fe75d", "comment": "Malware payload (Formbook)", "value": "bffc61fa29a2724342694be2a03c7548a19ea23909b41c9a6a9476dc89ebcb1a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689758528, "uuid": "7343ac3b-f793-415b-bce5-083ef9a0c4ca", "comment": "Malware payload (Formbook)", "value": "34fbc5bbb5da328d1d68f26c94669b50dbc92d3c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689758528, "uuid": "88943616-4d49-4326-b9d2-1bb3ff642113", "comment": "Malware payload (Formbook)", "value": "5b9ccb42753f2797a809908e84cf5abd5d4aeb994c035b8204b1a0260fdd73e17e456b32864a8c3c29faf7a8521e8fb3", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689758528, "uuid": "9cc0651b-3847-44ca-890b-7b56def73e84", "value": "T1684423D250A189D06FFC94AD4A621D3DB433275AEF57BF8906636F9FDA40DA03361831", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689758528, "uuid": "6dde3e3d-8b0c-4ee3-a30f-ef8ec5d6f47f", "value": "6144:oefskHofNr4Afq6oz3Slf1EhU053tlVkmz8IH:vEkHkJc6g3o1EaQ/Vka", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689758528, "uuid": "fed1cdb2-542d-4935-a591-29d87d00d9c3", "value": 263983, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689758528, "uuid": "fa584754-9b32-4c4f-990c-f4f2b2c44301", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689758528, "uuid": "dab5a32e-f950-4c08-91f6-ae230f2f9f16", "value": "Swift Copy.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75e53395-25fd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1689748102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748102, "uuid": "cfa39edb-c67e-4350-8327-db70fad5754d", "comment": "Malware payload (Formbook)", "value": "57d8b89de496140836fb236850f1f5c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748102, "uuid": "6a6d7835-c77d-4dcd-adb5-b54251c84943", "comment": "Malware payload (Formbook)", "value": "c06a41f8cc26ea5c1258decc9ac07f2014b29266b4a3a7c0d7183dbc706ffeed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748102, "uuid": "59dac482-8480-4026-9776-535cddf47a26", "comment": "Malware payload (Formbook)", "value": "beda7ba39b0ae594128980f8291d0f3a7af6c051", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748102, "uuid": "cf058ae4-581d-4157-a509-2f9105319e06", "comment": "Malware payload (Formbook)", "value": "737d4f93ff39a74dbb9ff79da42bf5a203f41e248ab14394b35a6b72d7b44c323862c6a12dae28e72d6c729689d505a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748102, "uuid": "5df94834-30c5-43d3-9125-758880b49c0b", "value": "T10A15B0A532DAD129EFF29F39C0D40104A5B1FC93F88A6E2571BA734616B7F814533B92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748102, "uuid": "e8bd195d-94f0-4039-ab4d-bf0008bcc4c7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748102, "uuid": "08bfb985-22fb-442c-b6eb-a6013519b3c5", "value": "12288:1hes/MhIaQkESIQaNdgGmB+XOi4cP7V+RpbZzjZk:veZrzpIQasGs+XC87SBZz+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689748102, "uuid": "6fb5c79e-2383-4236-b75f-b8d441586f30", "value": 916992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689748102, "uuid": "413b000b-0a6b-4aa0-93e6-f202f67d9b42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748102, "uuid": "2420762b-aee2-4651-a836-a3cba16d682e", "value": "FACTURA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aa1b43e-2627-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Hydra)", "timestamp": 1689766122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689766122, "uuid": "57f40bc4-14a8-4b19-8def-44afed15073e", "comment": "Malware payload (Hydra)", "value": "bd1343dd83646c33bef3c09d36230cad", "object_relation": "md5", "Tag": [ { "name": "android_hydra", "colour": "#626579", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689766122, "uuid": "7717442f-51f8-4052-a7fc-238b7e3adf51", "comment": "Malware payload (Hydra)", "value": "c122a6239274541beefd088f59a4c8cda18ef6357ca15a5ed0f13cfffb879cc3", "object_relation": "sha256", "Tag": [ { "name": "android_hydra", "colour": "#626579", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689766122, "uuid": "f1d5a8bc-8399-4fe6-8ca6-da98c4038ecd", "comment": "Malware payload (Hydra)", "value": "53c4382dacc7d458a24b9aa310b296aaba6951f5", "object_relation": "sha1", "Tag": [ { "name": "android_hydra", "colour": "#626579", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689766122, "uuid": "dac0faf1-6e0c-4812-89a8-1c86bbe19b4c", "comment": "Malware payload (Hydra)", "value": "aa38d3773315e7223cd7a0d776e54345f1074e4824221f2d1452147b286310a138fc0f951257e84c1e06878cd0739913", "object_relation": "sha3-384", "Tag": [ { "name": "android_hydra", "colour": "#626579", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689766122, "uuid": "533f851d-b239-42fd-ba63-1227dbf39231", "value": "T1C5163311B8EC562AECED6B7D5823E0990EBB3E12DF02A25FB068735D55336D08F111B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689766122, "uuid": "4f5430a3-89f5-421d-a6c2-5021e33da88f", "value": "98304:PIs/mEgx4huEEj8pSb5iQN8RUIRakjadd20sHM9:gs/m7xwuYmYQNeakGPT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689766122, "uuid": "541e2631-fabd-4ae6-9991-6d4e12bf576d", "value": 4044353, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689766122, "uuid": "95dcadce-01f3-4a8c-b103-2482e4582ded", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689766122, "uuid": "e435014f-7fbf-4d83-9ec0-21f91456e5e2", "value": "4-aligned-signed_en.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c2893be-2611-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1689756676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689756676, "uuid": "0c2c0376-46d9-45dd-88bd-71bf3aaaac1f", "comment": "Malware payload (Loki)", "value": "aa5c8d0a6e9cb485c33f44b746535a03", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689756676, "uuid": "ac24a66a-c46a-4acb-a9a3-31e4fddf0bba", "comment": "Malware payload (Loki)", "value": "c14c3d37c37ef89194d9a7d735437fbe100190526b535a667d8279371488fcb6", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689756676, "uuid": "f8c0fb91-e883-4fd0-b581-a4e0a4a60624", "comment": "Malware payload (Loki)", "value": "b33a616644a8c836d793cc05da0bb458c68caf2d", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689756676, "uuid": "91f25dff-b653-4c03-9da7-fbb0c1379f2f", "comment": "Malware payload (Loki)", "value": "ed69a3d637f6699a89bc6a3bc778790ddaca67eb181d5c935fbd6999a4a14945667cf34b1320b7fac151ab3f9b2482fb", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689756676, "uuid": "9fc27da9-a1da-4d5a-a858-2234f9b68537", "value": "T1E7B4232153D1FB6FF493A77E8422EA34115BC3114AB1A86EF02FE13991DFEA21861C95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689756676, "uuid": "793a2f6f-1539-46e8-82a3-5da3a88354bf", "value": "12288:G0BMfSN4ZpAmgjj9y0lDlefxd5VEwthPJrE+ItgofFVS:GIypGJlDQZd7EwthP1ItHfnS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689756676, "uuid": "a1fc5d49-4506-49cb-9ae9-c895df816c1a", "value": 512442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689756676, "uuid": "26ab1ac4-2dc6-43be-92eb-fa69c53964c2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689756676, "uuid": "01399b05-37a2-4cdb-ad3c-82b38b3042bd", "value": "AWB3345808270.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a555ef5-25fb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689747090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747090, "uuid": "69547b09-c75f-4d52-a80c-07d4298ea431", "comment": "Malware payload (Mirai)", "value": "5dccd532b5f55d8a64ae8ac4680a418c", "object_relation": "md5", "Tag": [ { "name": "2-59-255-213", "colour": "#A4F8B9", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747090, "uuid": "d2befa6c-08d1-4438-b57b-efa206303af6", "comment": "Malware payload (Mirai)", "value": "c17ea2e0589b391a424a8f29118f85ebd894e2f20a0de99f272a16d956df5a22", "object_relation": "sha256", "Tag": [ { "name": "2-59-255-213", "colour": "#A4F8B9", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747090, "uuid": "68bfbea6-ad60-4f9b-a705-05c416685042", "comment": "Malware payload (Mirai)", "value": "941bc42ffbd594be5c55fa6de7f5fc84c0f1122a", "object_relation": "sha1", "Tag": [ { "name": "2-59-255-213", "colour": "#A4F8B9", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747090, "uuid": "be781d09-0285-4902-a434-0be7bb50ea33", "comment": "Malware payload (Mirai)", "value": "6178725b990a64d0340b4159dff2e8b9f49cf9b5bb0e9d67a8b7fa154956021998c4d22ca5857bb82e0049f0be808346", "object_relation": "sha3-384", "Tag": [ { "name": "2-59-255-213", "colour": "#A4F8B9", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747090, "uuid": "2ab53a83-34ec-41b8-9fcb-8395bfef8e65", "value": "T1C9D2E1EE669079D1CD5C2D3DA2D917A6E90231C074F7869CB73608C16332A0FA58C9F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747090, "uuid": "c221563a-887e-41bc-bfaa-495b57ecfebd", "value": "768:qB25Pk5MJaavB9iidUEaXMEtPLfVkdKsLq4tW9C:qB25Qq4UOXxtVfk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689747090, "uuid": "12083328-103b-4067-8ded-012ffc38572b", "value": 30728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689747090, "uuid": "c50a072c-4ccf-461e-8a2e-1ac1a5832225", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747090, "uuid": "905c4a63-1c66-40c4-8bff-1be7c748a265", "value": "sora.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30f24298-25f8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1689745839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689745839, "uuid": "4ef851cb-e42c-4898-bacc-9e2e25eeb7b2", "comment": "Malware payload (AveMariaRAT)", "value": "3c9fa806196ea4178c3ffa0bb29187ab", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689745839, "uuid": "d91ded43-93dc-4fb3-b5d0-81b6b3c0def3", "comment": "Malware payload (AveMariaRAT)", "value": "c249946da5fb844b02ce93c31234925695482e80738bde487b84f581bfcb113c", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689745839, "uuid": "250e98af-5fd9-4de9-92d1-00867941ed77", "comment": "Malware payload (AveMariaRAT)", "value": "a8caf7f4e054e8f9b34320eed6a09859c31b8c70", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689745839, "uuid": "ea40010e-4dea-414e-af2a-04c43383040a", "comment": "Malware payload (AveMariaRAT)", "value": "f7183f309f6770a45a3e7a227f108c18fff8f6660a24e6fecf1d18aae783078820d024ef45b2d8950d7a9c4e51ea0a06", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689745839, "uuid": "18c8133d-7a0e-4717-a3e9-057f273063c4", "value": "T17284DF2E6AD221F4C5948D30F7F960FD41F1572F6916BBEB149412FAEE6671E30020BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689745839, "uuid": "ff97eea0-7d05-49db-b43b-43d78ffd6234", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689745839, "uuid": "c06e58fd-4fef-4b56-bae2-69204cf991fb", "value": "6144:x+XYDIdyvkfesBJtJsX/As4aPbXfALVdfW:x+XY4yvkfvsXIsZbPYJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689745839, "uuid": "ce3ef0a4-f9bd-460c-a368-66082dccc845", "value": 398336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689745839, "uuid": "7c48f3cd-4612-47ef-a201-bd9cdcca5571", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689745839, "uuid": "d64acae8-3cbe-4d25-b1ed-524a135d35b3", "value": "PO# -RDPLI2023-200702.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac961719-2628-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1689766663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689766663, "uuid": "9131b7e4-5020-477a-8995-b223c301b5bb", "comment": "Malware payload (Formbook)", "value": "7d0a76fa36db6001f96c6fbcde5754ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689766663, "uuid": "1476ac62-0c5e-4bfa-807e-8ea8184d7f34", "comment": "Malware payload (Formbook)", "value": "c250549bfd9382d9489d8a0905c0b8bde28ec07f5af5d8b92e4ec8eb6cc72248", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689766663, "uuid": "97ecddba-975e-4b2d-a3d4-cec98d22ffc2", "comment": "Malware payload (Formbook)", "value": "a7f833c726e2bfa2c253d353f848c246a0d8ee61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689766663, "uuid": "1c89ab93-ca2e-455e-8a16-72ad6582923f", "comment": "Malware payload (Formbook)", "value": "2e263e74921f428e687eb2e853247be59120a78cc62ef2c3548a595a1c05e3fee77411854d1771a78512e9570ea045ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689766663, "uuid": "ae9f8cbe-f9ec-4619-ae6e-49d028bacb91", "value": "T14AE4024075F89B13C6A8C7F50324A70563BA9EEC2061E56D8FEBEDCB7166F041A50D1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689766663, "uuid": "86782c66-1b5e-404f-bca8-3a0fccea4ff9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689766663, "uuid": "38831f23-3a9f-4436-a32d-8d991fa31cf3", "value": "12288:JUPYPfY7L3UsB6itBcf7YY1JR1jcLxDk7rQy9+htV:iPYPg/EBiXcR1jgyrQy9+htV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689766663, "uuid": "d6d25aac-2d90-4b25-a363-9a6626c0aacb", "value": 664576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689766663, "uuid": "c079620f-c241-4b0c-a9e3-04d54cd0e613", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689766663, "uuid": "c75210d2-6e0e-4cc2-ab3e-398e43fe78b0", "value": "SecuriteInfo.com.Win32.TrojanX-gen.13405.8015", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "810355f6-2610-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1689756282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689756282, "uuid": "1bf800aa-163f-4a11-b5d6-fec82a10b543", "comment": "Malware payload (Loki)", "value": "811e170bc7caefd78268c50d944e15b6", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689756282, "uuid": "3bfb5982-5604-438d-8c6f-8afa39de130b", "comment": "Malware payload (Loki)", "value": "c31357b6b85888851de9a55489084ef063358bcaf81dd74d165654f4631535fb", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689756282, "uuid": "a3fc20c5-9842-4113-aa0e-0a2e83e06bda", "comment": "Malware payload (Loki)", "value": "fbeee2ae1e89f880143b45e7f0d5cd0d81c61b3a", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689756282, "uuid": "ade15cfd-5c9e-41c0-827a-6998ab741685", "comment": "Malware payload (Loki)", "value": "8a15790dab134a0bdf3d4d2f3401a549d5462ab04b4998a0d9caab1b650a6b4a5e0faaedfcb2e5c966b873615e47dc30", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689756282, "uuid": "a9734d9e-348f-4b19-9eca-50eaefd01e8c", "value": "T1F0C412001EE5EB2BD05B3F7D1011B6F582A84FD27505C6A74C0AF0B9EB9AB4E9D81B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689756282, "uuid": "b169334f-1685-4aa1-8988-494dc1edd5d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689756282, "uuid": "e734b848-b5e9-4278-bf6f-881da2db568f", "value": "12288:imAY2kcdbL4EfnRmOjPEAOYlDnGJxjn2WP9HLrVPJ3EaQAfu+:rN6GEfnuA/lDnGLD2WPlXVPbQAf7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689756282, "uuid": "99aaaac2-2bd3-4f43-9eea-0aeb4d8e6945", "value": 553472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689756282, "uuid": "8a40e034-75aa-490f-9596-882de5bf3ab1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689756282, "uuid": "76b68c84-9816-40d8-af3e-faa62ae08879", "value": "D02397801.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f037f09e-2634-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689771930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771930, "uuid": "793f9e54-e46a-4eba-809b-e02556455fa1", "comment": "Malware payload (RedLineStealer)", "value": "e4a0b326beb3df02ff9e2dc038fb7447", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771930, "uuid": "e8e02d60-4817-449a-bd76-24b32a6a4669", "comment": "Malware payload (RedLineStealer)", "value": "c3351b9100fbb29327246c89703cd6d89dafd5ada133c51b9fdb6eddd228524e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771930, "uuid": "b4f2b110-7ef5-448f-bc71-f30d9569e439", "comment": "Malware payload (RedLineStealer)", "value": "49900ab0f7cb69b0ec26fcd1962706b9ee7bfda8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771930, "uuid": "f8cde6bf-74bf-4544-9345-91f52dbc5a52", "comment": "Malware payload (RedLineStealer)", "value": "fcee093c55f992ef36fdc069076d3ce99fecbafaad0752bcf78b84935fd7999099a6d131086288337a67587b01b55239", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771930, "uuid": "124bdf2c-68a4-4fda-87fa-fdc03ef7eb74", "value": "T1BB84F112F7E88432E8B41BB04DF616C31F7ABCA19D64E36B2794544A0CB3684E57673B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771930, "uuid": "452f2d31-b6c4-4d2d-89b6-961464ce968c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771930, "uuid": "2c119a2b-6d99-4ce6-a862-620bb20dc29d", "value": "12288:gMriy907DgST0iUPxoREdIIN5rHncHnl945QXMuem:SyuUiUPxoR6IIN5cHUluem", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689771930, "uuid": "a10b17df-5d8d-48d6-b57b-d91d1f335018", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689771930, "uuid": "7174923f-af75-48ca-ae78-397026a9485f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771930, "uuid": "af5805bd-7602-4a48-ab81-dfcc34c0bb9b", "value": "c3351b9100fbb29327246c89703cd6d89dafd5ada133c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d269ec3-2666-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689793266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689793266, "uuid": "139abb0d-d918-4411-93d8-073b9d4eea04", "comment": "Malware payload (RedLineStealer)", "value": "3ee8880cc5b4149de2df1cc37d5742cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689793266, "uuid": "4b618205-8d74-4d27-bff9-f0aeceec228c", "comment": "Malware payload (RedLineStealer)", "value": "c3aa52db6226368c7c3760f38bc558eaace9dd50d515b6758996303df0cf660e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689793266, "uuid": "f19189b1-768b-4272-bd33-42d4a37e5882", "comment": "Malware payload (RedLineStealer)", "value": "f4cf8ed47e04da25a4d960a5004e11b34ed3d811", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689793266, "uuid": "929d7e5b-bab8-45cb-ad62-fd036da9f478", "comment": "Malware payload (RedLineStealer)", "value": "a095c9430df6d030ced02b71d060e2fdca7dbb5758ca327149cf72d18f5997669b1968ec040c268ef890aaf2bb1882c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689793266, "uuid": "d97422ca-d16a-43d4-88fb-4030cdce1e73", "value": "T1F7840147ABD95172E9B817B01DF703830F36BDA29978466723816D5E0CB32C0A63677B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689793266, "uuid": "a30eab6d-b3d5-4a47-b293-f8a65936adee", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689793266, "uuid": "6543f4b7-c40e-48d0-b82b-5098338a52a3", "value": "12288:8MrTy90b4m3wXfpABiHDHGoCo+Sp/vb/2I:fyeB3pQFb/n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689793266, "uuid": "e2b01157-eb17-4cc5-87b4-8cec4293e86d", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689793266, "uuid": "0ebae4e7-7941-4601-9ce0-30ed5b2fd7b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689793266, "uuid": "cc29a5a8-b56f-429a-b26a-a2dd3b34f783", "value": "3ee8880cc5b4149de2df1cc37d5742cf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "253943ad-261f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1689762570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689762570, "uuid": "1878311e-9e2f-47d6-9a7f-3a630e2603bb", "comment": "Malware payload (Formbook)", "value": "9db885c6287e9796421edc4afabb7cb1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689762570, "uuid": "35b6f3de-5de5-43b3-8098-3d8130b522bb", "comment": "Malware payload (Formbook)", "value": "c4079f3f904aaaeda007ba7ce93f24d8a47eb749be233eaf87766e12fcada032", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689762570, "uuid": "14bedb54-2fdf-4cfb-8561-c2841c519610", "comment": "Malware payload (Formbook)", "value": "a2c5d2920670f71911756096982e7ddb84f8e8cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689762570, "uuid": "073d5e75-8ea4-46ce-98b5-5583bfcceae4", "comment": "Malware payload (Formbook)", "value": "a7801531a02d57c437c1312bd88bc99460c6a3b6a13bd6d08dffc38e3da549bc1bb85c404f56ce29d8fc596c9135ccdb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689762570, "uuid": "db3d9552-300c-4fc2-8857-9c0c2df97506", "value": "T1E7E412103AA4AF13C5E587F943646B40A3BA9EEA3421E55D9FEBFCC77261F111A40D0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689762570, "uuid": "4bbc7ed8-82a6-4b73-bea0-c87864e4c77c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689762570, "uuid": "51d2cb9e-be08-4f7a-b9b3-6ef82accc0f3", "value": "12288:SIPYPfY7TLlFqyOKxVD/nx1gqjTm5yYHzV/KQ7oWvD+04jyI:/PYPgLWyOK3ZljQPTUm3Lf4j5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689762570, "uuid": "08b8708e-28e6-4773-86e7-f7433f05e11d", "value": 661504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689762570, "uuid": "5a8a683c-c1d4-4a0f-8ab9-93730d977d5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689762570, "uuid": "0f61afb1-5571-47ab-bc87-dae155023e35", "value": "SecuriteInfo.com.Win32.TrojanX-gen.29025.15899", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d1932d1-262c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1689768194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689768194, "uuid": "f3b795a9-da37-43bb-bd8f-2682bc4c6d1c", "comment": "Malware payload (Formbook)", "value": "f3623fd8b9446e301b0d1bd390ef841e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689768194, "uuid": "b656113e-569b-438c-a845-c9249d52f2ef", "comment": "Malware payload (Formbook)", "value": "c433841d01e8b7901e45455592fd6db08dd48b4caf2682d3222078018475de60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689768194, "uuid": "fd09d460-4856-4228-ba92-5c53de358b73", "comment": "Malware payload (Formbook)", "value": "2aaa5191d6cd4699286cc9b2532ca844c8d0b474", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689768194, "uuid": "1e5e10b2-fb72-40fb-bcf6-25d78b968dee", "comment": "Malware payload (Formbook)", "value": "6f5c533590020d83eb531483b3b69099287d0fd21619359d4e0a8f6f12aa48b880641647d07a5557338fffdbef27f9b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689768194, "uuid": "d8119df2-a0ee-425f-9680-e6b03b1d6bc0", "value": "T13E54126932D3E7A3E8F38170DE7DA676AF9EB15210A0514F37105E69BD02392A41F313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689768194, "uuid": "35fef567-ebc6-42d5-ad99-d8b88bbf6d82", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689768194, "uuid": "9a1cfaca-28ee-4bec-838c-f09c7db2cdba", "value": "6144:PYa6ii6SUdJc9/lRTT3aSpE1bsDESxLH/rO2kAFTMChtx:PYk7zs/TTTKwERsdLfrGRChtx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689768194, "uuid": "3b4d2281-6d4b-427c-ad39-e8e8a6d9fa2d", "value": 284031, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689768194, "uuid": "a7e07de8-d01f-4a3f-88e5-cd4be4edef44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689768194, "uuid": "9414cc02-6fea-4793-b5fb-0299a8a7d21d", "value": "HBL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "835e2790-2644-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689778619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689778619, "uuid": "d1a79e5c-a035-4988-91a1-04aaf62c5f55", "comment": "Malware payload", "value": "695f6bc6a0c9fe1b5954158a4e4775c3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689778619, "uuid": "5835c690-08e9-4b33-a72d-a65e6680e4e1", "comment": "Malware payload", "value": "c473f1091372dbaba567e2416219ba639bdbd2d41818361452e1519d4b9c1975", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689778619, "uuid": "77f47743-a954-44d6-b434-63dafc750d46", "comment": "Malware payload", "value": "5bfbc35d1b795953b65aad1ad7ab085eba367d62", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689778619, "uuid": "6467972b-efc7-4065-a95a-8a67bf870e67", "comment": "Malware payload", "value": "92c4c0f7f83aeb99430dadbecdabe83e0611752809867d6362b4310e145ac4e2949f35332c4aaa9a885b10c675281095", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689778619, "uuid": "0de3db2d-5019-4d1e-8126-9906566a1e4e", "value": "T1FF943211A3FD5208F6F73F846DB5A2A44E26BCA6ED79D2AD1250105E8AB2F40DD70733", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689778619, "uuid": "ca453c07-0c13-401d-be1e-4d471fe61c86", "value": "3072:JPh4mMKHdfKqeZ+58Hfrcx1GkjidSx065kMY+tzq8f:5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689778619, "uuid": "4a079ec1-9a8b-40fb-af7f-d9b5c6d93fb6", "value": 445962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689778619, "uuid": "b1744599-2248-43e7-bcde-1a6999fdffc6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689778619, "uuid": "91a7e964-c14d-4fc2-85d2-caa2fc76aa43", "value": "data_19_jul_2929767.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57c240b2-25f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689745475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689745475, "uuid": "ae1bbd2c-936b-4606-93e7-1794a5cc95d4", "comment": "Malware payload (AgentTesla)", "value": "5b166feb1143b979d5dc5993bbea221b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689745475, "uuid": "cbe4c6b3-ea2b-4d12-9d4d-b971b968ad23", "comment": "Malware payload (AgentTesla)", "value": "c54efd3c41e975a8e0ebe58f326091fc3a41979d6708341d50225cfcb3003918", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689745475, "uuid": "bb8b7335-8d4b-4af4-bd81-061e7cd964d0", "comment": "Malware payload (AgentTesla)", "value": "8db46d5a115b6f376aea140e49d63249a9b9f6d6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689745475, "uuid": "e312b17a-42b9-4fc6-8683-68bbe54716dc", "comment": "Malware payload (AgentTesla)", "value": "85c2f3a355b8ed05184946f22e8bead4acc09505935752f1416d7afb9f78e244427a551fe5137a8725644801d660b0d9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689745475, "uuid": "a5adcbb9-0f06-4033-adf5-8c8792b35fb3", "value": "T184F4E010362C8F17D8BCA3FD9564511453F95A57A62EC3498EC33CEF39AAF414B42A2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689745475, "uuid": "0c9381b1-2402-443b-a9c5-ba8d20f94a88", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689745475, "uuid": "e57ecb27-a37e-44fc-a6ee-77db52a113a0", "value": "12288:Sf+28cW9RojRfb/WT4UkuZNajzWWzPxsbCj/CssVIX+EpuESXq5ZM+11jf4fdg+W:SG28cW9RojRfzW/ZNUWoGWzxuEuzXITG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689745475, "uuid": "a212a7fa-008b-4887-bbe4-501e8df12de6", "value": 754688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689745475, "uuid": "30e64dc7-4267-42f8-a6ae-8d17a1e7a4ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689745475, "uuid": "c9606098-82b6-47e8-b4e2-5724f8fb09fb", "value": "Credit Details030839.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9050aa66-260a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689753730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689753730, "uuid": "771cd14d-a452-4622-9372-b0e0f2351fb3", "comment": "Malware payload (AgentTesla)", "value": "f192b295d888740f43dba9b044198eb6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689753730, "uuid": "6d2869e2-c559-40ab-a283-191406a4582a", "comment": "Malware payload (AgentTesla)", "value": "c6210dcf361f7262cf37010424bfc6577e23dbe34275c63a3152fef63885d0a8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689753730, "uuid": "775dbde9-530b-44b2-b6c8-356d99748337", "comment": "Malware payload (AgentTesla)", "value": "339ea7591c5628cdfd687e1dfacfc168e312371e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689753730, "uuid": "74b7b284-c8ff-4e88-970c-48e200a7a7ee", "comment": "Malware payload (AgentTesla)", "value": "e0d33c749735377acffe1ce71db2073f73445b5d1032ee7bb8eab6827b093f40a0f740ec9dac86dcd11f5266ee6163e4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689753730, "uuid": "36329f8c-7190-472c-947c-24fe779b81fc", "value": "T197D41244B79ACA6AC1F903FD26A09B0023B86F552162F51E4FD6FCE97467B100B90F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689753730, "uuid": "9d03fe71-ba42-48af-9d25-ee4383acd67d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689753730, "uuid": "7a7ccfa9-1565-4637-a729-3ebf8dbfe3ea", "value": "12288:cPYPfY7rZf6XpxJaOfoNYPne/AZV4j5PtV8bLRK6sRT7cNkcWPIJUe3esPe:cPYPgcJadYP4dtGbNKTRUycWPIU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689753730, "uuid": "e1c38219-fe24-4b55-9e75-0514a6896f39", "value": 652800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689753730, "uuid": "00202083-6d60-4953-8c4d-c98570817218", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689753730, "uuid": "de826d8c-4b0c-4132-91ca-48b744849a43", "value": "EPDA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf7b7677-2652-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1689784733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689784733, "uuid": "352779f1-a1e7-47ef-b932-da85b0aa86d0", "comment": "Malware payload (Formbook)", "value": "97702ccb395cb121a0a1c8bc10134fed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689784733, "uuid": "693a2ac1-4e3c-4506-8dd4-77a02f26c2d3", "comment": "Malware payload (Formbook)", "value": "c63fce3a675e641aab29aca12d4e54f155f24c4476ee3d13ee9b21fb6a341557", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689784733, "uuid": "33378734-b105-4ce1-b1da-f0bdc261f341", "comment": "Malware payload (Formbook)", "value": "66e0f215028eae0bc43333f788a3f106a8fd5e4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689784733, "uuid": "bde3faf5-da65-4b99-a484-e5fdd7e4d3e6", "comment": "Malware payload (Formbook)", "value": "387660b61510024df063988b94d181d98ffa01662d55eb7ebab07d78c6e17b4f11eeb11cca44ee6602e66450b04c9c24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689784733, "uuid": "01634e8e-a498-4c16-a33f-bd31a41dd9d3", "value": "T19544121933E2C1EBE5420B714F75572BAFEAE82264E84B1F07506A94367A983CA1D353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689784733, "uuid": "a113e4eb-d0e9-45e4-ae71-25054fae0d3a", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689784733, "uuid": "8725bebc-b084-4350-bb21-0aa31b728af4", "value": "6144:/Ya6e43+yUIvv2pnqe7IbB9K8rqWI8orPwyflf2tg:/YYxyJsJ7I93tuPNz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689784733, "uuid": "5a6fde0c-0cc1-4e58-bc18-e7222911de3a", "value": 262572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689784733, "uuid": "5f9612e8-af11-4b3c-a332-9c816b58103b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689784733, "uuid": "c6ef349f-54e9-42b7-8994-f6751ab74149", "value": "vNdEP98IkQMac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f0d6f95-2659-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689787551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787551, "uuid": "d037aae1-815c-419c-bb54-b74b16617034", "comment": "Malware payload (Amadey)", "value": "7674a32368defbb404c87560f0791faa", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787551, "uuid": "e0e31d82-24fe-4f74-9102-4bce66558261", "comment": "Malware payload (Amadey)", "value": "c6b05be55a764db43c8bec80fa05af3730aa099c95f9814c8204076ef28a1da9", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787551, "uuid": "647485d9-c6ab-4f00-addd-6384f67c0d5c", "comment": "Malware payload (Amadey)", "value": "cc89bd22739d9dd8ab9538f20f410047ecad86cc", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787551, "uuid": "de1084cb-ca5a-45a9-8967-8ff17b65513b", "comment": "Malware payload (Amadey)", "value": "7e40c1ad231d3c9abe03b3239cd52f22309c2d8c6ee2dc07c5cf29f501e50b5b96512bb15853dfbd9bae404c1ea39244", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787551, "uuid": "d49308bb-9721-4ad1-9e54-53208f27dd9b", "value": "T1B0840262ABDC4032D9B527B018FB43D30F36BCE15934836B2795A91E0CB26D0A57677B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787551, "uuid": "d120712c-00c9-4308-9cb0-d2aebbc2ba76", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787551, "uuid": "d823fe7c-9fb2-488c-aad9-f0c92e970c18", "value": "6144:K4y+bnr+8p0yN90QErv/VTmZry4rbkN053aee66dCRUEWGLMj0y:AMr4y90lnVTWryyxO6DDJS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689787551, "uuid": "18ac6aba-9493-4b63-b178-313604b7baef", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689787551, "uuid": "1cc6a710-8c28-49be-a756-7041c73ad29e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787551, "uuid": "73c06866-fceb-40cf-940b-8dbe606d9e90", "value": "7674a32368defbb404c87560f0791faa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c561e97-2630-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689769830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689769830, "uuid": "de95ae06-d769-4f02-89d4-64d719af935b", "comment": "Malware payload (Amadey)", "value": "b2971e22c8fca83829bad2afae84a0c1", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689769830, "uuid": "32393f0a-4c0a-439a-82b6-6fc4f7bde32f", "comment": "Malware payload (Amadey)", "value": "c6bd926d58aa119662ccfb970124884439404950b8aa818378fa47a61a658a44", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689769830, "uuid": "0e1b70be-0003-4df2-82b7-24fe768c220a", "comment": "Malware payload (Amadey)", "value": "4d3a11d21db1e95e86e79382e8600da710158713", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689769830, "uuid": "1c585082-cc47-4544-8668-7bad08907d02", "comment": "Malware payload (Amadey)", "value": "6f5c3795b1d9cd91d69ac24580c8f8fbb8dc4671e0b08cff34c2fa6f363104d5ae2a0f4aa13fadfe1ef766286c4b2adc", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689769830, "uuid": "f5f3be11-9eae-44a4-90df-68f194ecfc11", "value": "T1ED840202F6E89436D9F51B705CF613C30B3A7CA16D7883AB2B86990E0DB3594A57173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689769830, "uuid": "a393d82c-b00d-46c9-af53-281e8e7d0d71", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689769830, "uuid": "17988e5a-5a28-4d7e-96ce-4b14cd816790", "value": "6144:Kiy+bnr+Up0yN90QE/QeKcFaMM8MIB88hU3846ZmHwTCcHnlRHSjpiR0NUcP:eMroy90qeKkaMMM/e8l8HvcHnl9eP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689769830, "uuid": "350db4e4-7908-45ff-bed0-adf1fdf309c1", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689769830, "uuid": "c4e2b157-f8d6-40ed-a353-4e73d4b321b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689769830, "uuid": "245d193e-8caf-4cf5-9a8a-e8d4a610dfec", "value": "b2971e22c8fca83829bad2afae84a0c1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "217b04f9-25fb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689747102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747102, "uuid": "0e88b0ff-d8d2-47f7-bea2-5fcd313a816e", "comment": "Malware payload (Mirai)", "value": "a1f5a229005ffbf7eb0f15bd4a5026c8", "object_relation": "md5", "Tag": [ { "name": "2-59-255-213", "colour": "#A4F8B9", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747102, "uuid": "d5747a50-3d37-4c7d-ae14-2c58cbced277", "comment": "Malware payload (Mirai)", "value": "c8542b04ea9e91ea501b95a913c778ea49e5c77a4a5a51a4bccb7f40a994d977", "object_relation": "sha256", "Tag": [ { "name": "2-59-255-213", "colour": "#A4F8B9", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747102, "uuid": "ec4aa982-15b6-4d74-8e8e-e501f42cbf5b", "comment": "Malware payload (Mirai)", "value": "7a638c98f5cfae0c04b216eac22a4266ad30df6a", "object_relation": "sha1", "Tag": [ { "name": "2-59-255-213", "colour": "#A4F8B9", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747102, "uuid": "418789ab-6306-4107-b3a5-7fcf944c9e83", "comment": "Malware payload (Mirai)", "value": "a798ca8754b9cde8c9a6f6c8be12ba05ac80f960d55cd92762170bf809b97ac61e09f8f1e61e2344ec9c2cf61b3cfa67", "object_relation": "sha3-384", "Tag": [ { "name": "2-59-255-213", "colour": "#A4F8B9", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747102, "uuid": "74e0a2b5-9684-4e8d-92c5-a6b7243e4672", "value": "T1EFD2D07D5A0118F5CBA0D4B80BEA0B645BA00EF524C2EDCB39D9F6D3C94566034C7AEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747102, "uuid": "487d02dd-4c8b-462f-9470-0eca13397d7c", "value": "768:y4chd88uI8Tor0tbO18ytnjbEwI68ehBJgGlzDpbuR1J+j:OW5I8Ts0tbO182jbvZ8ehTVJusj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689747102, "uuid": "5f3539fc-11d6-4f8b-b6bc-2204b04c9a2c", "value": 29780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689747102, "uuid": "03852dea-2e0d-4827-80dc-d1b20359951c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747102, "uuid": "6c730ea0-d1f8-4233-8f17-54ac730229df", "value": "sora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34ea7c3e-2632-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1689770757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689770757, "uuid": "9ea6fda6-278c-4a91-b786-56a65da8fc15", "comment": "Malware payload (SnakeKeylogger)", "value": "b055bd0d99ddf898f9e8c5a6d44397a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689770757, "uuid": "ebe49133-417e-4779-abfc-7f280ff3104f", "comment": "Malware payload (SnakeKeylogger)", "value": "c8c54f7e8f956310286f3cec8d17b597d1bdb945667ca5748fd33eb202ee7a41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689770757, "uuid": "24c36da2-627f-4a20-8412-69f23f2fcb8d", "comment": "Malware payload (SnakeKeylogger)", "value": "8ec36cd09ca9aeb38ac1a45d2d6177e485da3a04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689770757, "uuid": "848e1ccb-b2ab-433e-bcd8-aaaee55c936c", "comment": "Malware payload (SnakeKeylogger)", "value": "5827192c4122d913928a8c90f8927ce0a2aed4e3935fc9d38ec1c7660378b8e1a978cd782e5753b718f53e8034c382e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689770757, "uuid": "901fe38f-4ebd-4596-8c09-cbadaf4c5420", "value": "T180D4121179B89B23C96947F95320E64813FA9FCD1462E12D4EEBFCD775A6F140A80E0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689770757, "uuid": "bdac2954-2f8e-454c-9564-db64284098d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689770757, "uuid": "62a97f10-cd51-47a5-a042-fb2ecef312cd", "value": "12288:iSPYPfY7d4lS3t2Ze48GXR3dLC/JQsGDioQ3:BPYPgJ4lEc1XR3dyJBGI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689770757, "uuid": "00df3586-6077-4645-9934-ddedcf32b67f", "value": 604672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689770757, "uuid": "62558e61-3bb5-4a7f-a9ef-cd8ee323a1a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689770757, "uuid": "68bdfe12-f56c-4a29-acc9-bdad5df91694", "value": "estatement_19_07_2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa60b31f-260e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1689755626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689755626, "uuid": "7d15364d-3900-441c-8f9a-542d411ef0f5", "comment": "Malware payload (GuLoader)", "value": "9347be5ffe763a68ee90d756dd4cf296", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689755626, "uuid": "e8608ee1-fcfe-4762-be0a-8451e67383ad", "comment": "Malware payload (GuLoader)", "value": "ca8d54933f63b2adb5495348a86f81b2f7dd51f341fca1fa684d52545a0ce51a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689755626, "uuid": "77fa6715-b72f-441c-b6fe-be32a2c88a03", "comment": "Malware payload (GuLoader)", "value": "b22ed88d5eb8e35d0215e13f2d2a13dd50ba9740", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689755626, "uuid": "4bb079d6-bf58-44f5-9bf8-192e7ee57c0c", "comment": "Malware payload (GuLoader)", "value": "b587057a5fed1f06c651f29dab6f0d2cf11278fdcbcb308ee6d7aa0bcc076651288f1e8dddef31ba536967bc65cbdcf2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689755626, "uuid": "c929441d-f3d2-4827-8be6-ccffd725a57b", "value": "T135A4CF04F7840B8BDD30CDFC029BCD5E25677C22987190A6FAA09ED16BE4B8D6D43676", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689755626, "uuid": "9bc763a2-6101-49a0-8b02-dfde98c2d458", "value": "d4b94e8ee3f620a89d114b9da4b31873", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689755626, "uuid": "e44a1257-e304-4d79-be26-4ad0fdebec11", "value": "12288:PvVhGt+x9EY9+15LCTnwimZxfOm3u4Mv87k:l8kgY9+15LCfmDXU/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689755626, "uuid": "bb8b941e-942c-42c0-8826-e664f8e82218", "value": 458877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689755626, "uuid": "ed1e419c-efbe-41d9-80a9-e000bc972d3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689755626, "uuid": "20bb9758-0c0b-4912-a2fd-90b3c30e74f3", "value": "CDE_8406727184_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0d8c761-2610-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1689756469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689756469, "uuid": "ed3d1929-7de1-4b52-a061-6b636978dd86", "comment": "Malware payload (Formbook)", "value": "d2b4d3fd4dcec357cfbd26b71d987986", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689756469, "uuid": "6bba2119-4d91-4646-9467-aa02a7ff9427", "comment": "Malware payload (Formbook)", "value": "caecbf9ecddd033286a2152fb2e655bf228998ec9d8d1024857e60b73855cc2c", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689756469, "uuid": "984abb9a-db1e-45bb-9b4c-92be1d7b6fda", "comment": "Malware payload (Formbook)", "value": "fbbecf3954783ed99f325ab948d06c061c1b7836", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689756469, "uuid": "593b1d18-12c6-4487-8ed4-eb30f8e48178", "comment": "Malware payload (Formbook)", "value": "1dace2fa8ac4d70bad6ed42f7b84a936f67b35633ef1dc141be83b14bdc52dfb42362a44884f5b467afa81ea7da71e08", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689756469, "uuid": "ef1d8996-a612-4f2b-a559-48b9f8ef2c61", "value": "T1BE44235CAF48F36FD4356253154FC4C8FFC70CAB8BA475A9624A105D43A812EEACA5CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689756469, "uuid": "841a0e33-78e3-43cf-9635-6ee8a7fb20d1", "value": "6144:8pKqnFiCSPTvGlgQL8YXdSOOLzzhf9ykCQaDsD:QlGvEh3er6nQ8sD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689756469, "uuid": "88507415-bec1-424f-af0c-487aa539c233", "value": 263496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689756469, "uuid": "92453db1-fa0d-40c9-bb1c-fae0b04c547e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689756469, "uuid": "6855ced8-5725-4655-8f07-08daf68ca2ce", "value": "PAYMENT TO BANK DETAILS (CONFIRM BANK DETAILS).rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30b97d14-2633-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Vjw0rm)", "timestamp": 1689771179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771179, "uuid": "116ac976-234d-4994-8b39-985778cced1e", "comment": "Malware payload (Vjw0rm)", "value": "33300fb747c6677625aa17d03e1010f3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771179, "uuid": "ebc84535-f200-4237-bfee-b126297f0b1b", "comment": "Malware payload (Vjw0rm)", "value": "cbe7d5663fd5359a72f88e44d083703d9625235929c31e0f5b16a0b42cb44d35", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771179, "uuid": "ce9637a9-b62b-4edb-821d-e17bd140a832", "comment": "Malware payload (Vjw0rm)", "value": "b1bea456907b59a8182a0f01cc0e90f6e32e2779", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771179, "uuid": "6786a63d-0751-4953-8052-801e6bb8644c", "comment": "Malware payload (Vjw0rm)", "value": "09f6b8f875b4a590bac5159540b3fd062b9b53b253ce98a1a87bc8ac83f91ba88e5a71e657e619fdb5cd3843a81958f1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771179, "uuid": "8191d596-6ac4-4131-837f-22e5bdd19689", "value": "T1352523C76E182A024363F029432CB71BDA64E91B3EA309E6AD857F8F977DC50457DB60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771179, "uuid": "a28c5fd5-da17-4ac0-aa5a-e30a456d85e5", "value": "6144:QQ7vErztQ9MZIUWrltWZV1+VJaMd5KVPb5emOJ62+ILfahP2CTLqO0EXZ9gsP7Ay:Te", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689771179, "uuid": "314d2242-c0ad-4a93-95c5-2f453f37ca82", "value": 1057930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689771179, "uuid": "e124a25c-59fd-44ad-aa7b-be290752513b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771179, "uuid": "946ddb1a-ba05-4fa4-9b5f-4139c64630ef", "value": "Tax Returns of R58,765.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6019fde5-2632-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689770829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689770829, "uuid": "e45d8e0c-6c22-41d9-8bb2-f988f739addd", "comment": "Malware payload", "value": "e24c880758a7e8b114908240f8f8537f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689770829, "uuid": "12fd2940-a3fe-47ad-ab56-5a3838fd40ec", "comment": "Malware payload", "value": "cc081c42b4c7b8d373aa4cc662d59112338a3cfbb22218f481ec248a7d1df437", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689770829, "uuid": "baa11905-3ce5-4cc0-9fd7-ca250792a114", "comment": "Malware payload", "value": "bb4ba5e04d40098f05d6acde30f7e1e6cd29119c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689770829, "uuid": "34e3828b-76ca-45d4-b2d8-65fb4631592f", "comment": "Malware payload", "value": "08cdbf6e9955a3c1ae2ceab430990471321f1ebeaceb2f1fc73f1d44c031f2afff1e3696420443a14a32f2af470860ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689770829, "uuid": "b4269550-9994-4307-9078-133a7e4f5523", "value": "T112D538A1B240F400F7429C37B08A09A1DA513CE3BF62FDF67E57B72827386E54589697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689770829, "uuid": "236e3f9e-91cb-4afa-9925-fa79e38adcf7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689770829, "uuid": "90a314f3-b5b9-432d-bdd0-1c9052677a98", "value": "49152:7iG+SUsvAJJyx03+tW2w8lr7NnlW3u12i4Fa:7rUsYmx03MW09suV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689770829, "uuid": "cfcec83b-8263-45a9-9a56-dacd0a55c353", "value": 2982592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689770829, "uuid": "1b2013e6-8fac-44b6-8205-a26d937cafdb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689770829, "uuid": "7abeed42-ea86-4e7d-8d7f-167a0e1d2f06", "value": "e24c880758a7e8b114908240f8f8537f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d35a5a7f-2629-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Hydra)", "timestamp": 1689767157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689767157, "uuid": "7cc06dc7-0138-44dc-b2ac-3916fa5d6f21", "comment": "Malware payload (Hydra)", "value": "e8e83c7e5094b7510e0a738a7fbafd6c", "object_relation": "md5", "Tag": [ { "name": "android_hydra", "colour": "#626579", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689767157, "uuid": "7cc8bfc9-e532-4800-93cc-f9f95f16b4c0", "comment": "Malware payload (Hydra)", "value": "cd3ff09b5070985a0797738743b1c62233918666b888dc4867cec9aa82cc5505", "object_relation": "sha256", "Tag": [ { "name": "android_hydra", "colour": "#626579", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689767157, "uuid": "9b3a8368-5cee-4ece-8669-d30380e8196e", "comment": "Malware payload (Hydra)", "value": "8319695f2a7a4c2f6050d922dd1760a5e8731064", "object_relation": "sha1", "Tag": [ { "name": "android_hydra", "colour": "#626579", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689767157, "uuid": "43c5cba3-22e3-43f9-8f1d-96296ac42d71", "comment": "Malware payload (Hydra)", "value": "0fd5d6e482109a36c5cfef40995b04efb17f191f51a13b9b4fbb01999d92f630a958b7a4d8c06e91fa5b5eaf5ac95b74", "object_relation": "sha3-384", "Tag": [ { "name": "android_hydra", "colour": "#626579", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689767157, "uuid": "ceb7303a-0055-41e3-8e7a-04b062bc0680", "value": "T1AEE5127BD4F2626ECAC893BB6498DE62A2E3774897538C0D319C33994B71ACC0F115B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689767157, "uuid": "904ad117-d7f4-41ca-a899-ee2c880066c8", "value": "98304:ZOh9u96MP1iXw8oHjEdQP6H5XJlNeG+tyD9toGhTWbBGZbRUIb3tgEjk:ZOhQ1qqmlD20Z1hDtdg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689767157, "uuid": "7cf4f46d-9e96-4840-8430-e029c656e32b", "value": 3321203, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689767157, "uuid": "3bc88714-8e81-45bd-9427-995c321d3c57", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689767157, "uuid": "61411f8e-ace1-4758-a191-11c99c379c81", "value": "8319695f2a7a4c2f6050d922dd1760a5e8731064.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe0da65d-2659-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689787845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787845, "uuid": "e74e93a5-1831-47f8-9864-3c2933ed46a7", "comment": "Malware payload (Amadey)", "value": "733461cf56bf4bacf02891b105bdef6a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787845, "uuid": "9dc74c65-230a-4738-acd1-28b175317967", "comment": "Malware payload (Amadey)", "value": "cd5f55e94154d69afbe4a476ece11651e479f0ab2ea53aaf9b83da16cb23f728", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787845, "uuid": "c02a44c8-b721-47d5-a5c4-0947a3d57262", "comment": "Malware payload (Amadey)", "value": "e74f6e7f8c0db2170887662d595d1ced45e8b893", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787845, "uuid": "ec4c97d5-9d3a-40eb-8e11-149735d8c4ad", "comment": "Malware payload (Amadey)", "value": "0021e8a15ed20762da897ec6a9e9db06b1344cfee921a3c4e2cd90de4cf62a9105de7ff62bbfea39c089e373abcaf3dd", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787845, "uuid": "eeea2edf-be5b-4d42-b9c2-a583018fb965", "value": "T1B3840153E2D49872EDB9277058F603C30A3B7D91AD3887AF3355686A1CB26C4A831777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787845, "uuid": "9d5a54ba-22d5-48bd-a36f-c3e1e02c1beb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787845, "uuid": "8a65437a-5c8b-4995-b078-c52ed351e073", "value": "6144:Kvy+bnr+bp0yN90QEZgUBCYkWcnZNrQ1e100tKxHCVmNkDX19MonxmM:FMrfy90bgCCZ00tMCcyDl6oxv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689787845, "uuid": "d37eff96-765a-43f2-ba9c-68501464cb55", "value": 398336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689787845, "uuid": "6b2ee903-d693-4851-ab14-fca2f5d665db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787845, "uuid": "5e054f98-9a7f-4200-a5f8-aef73cfba653", "value": "733461cf56bf4bacf02891b105bdef6a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a5dd93a-25e3-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689736809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689736809, "uuid": "3e2bb658-7d02-42c9-b0a1-2f424c24a921", "comment": "Malware payload", "value": "945e3bf7c8dafb5bdd848686d91831e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689736809, "uuid": "2a0a56dd-d476-4247-be37-fdddc5a5e044", "comment": "Malware payload", "value": "cdb4c42565d6de1b67619bc3663f69747c67cea9698bea1550cb5b728efac28e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689736809, "uuid": "afc838f5-6907-477d-9c96-970561a2f8d3", "comment": "Malware payload", "value": "e3caae3e89440e5a06c3fef8db045df4dd52bdb9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689736809, "uuid": "25a37d3a-80a9-4952-8caa-142551210465", "comment": "Malware payload", "value": "f977a7297f33611f7678ee7acc9164c00938dd243331778d57b22fc4a97d51462e3f004a956b13b8d3c398e7ce40104c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689736809, "uuid": "98839ec9-9467-48d0-860e-266c978a3beb", "value": "T1D5D4CF81B39095D9C4B88430C693CE71CA317C64DB28569BB6D4BB6F2F32AF1653731A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689736809, "uuid": "9f711252-8b78-4ea8-b676-dc4b0c2e3a9c", "value": "12288:y72LPfhyL8X8jm3lRkRc4YFwjsWAfRgantPbceTn7axerx7:eafhSW8S3/kRc4lAgantPbcSn7a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689736809, "uuid": "8e4b86f9-8ef9-437d-a466-11246f8fed84", "value": 605184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689736809, "uuid": "49010ef7-057e-4bd8-9f40-87e15f2b6a93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689736809, "uuid": "20a94e9d-8ca8-4597-bb6a-8ccafb815118", "value": "okka25.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a193d50-2671-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689797877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689797877, "uuid": "2ff7dec5-3381-4503-b8db-7e3f51b9cb3b", "comment": "Malware payload (Mirai)", "value": "ca328f03c9e7d19d4cb1ec98843cb5bc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689797877, "uuid": "0500fe4d-3ebc-4c89-a31a-7caad68d1105", "comment": "Malware payload (Mirai)", "value": "ce2b289039b081f0be5dce38437668f902ab1b6cd1bca22896c2f0fbd6283f71", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689797877, "uuid": "9cbbb353-64c3-4707-9a1f-9216da57c69b", "comment": "Malware payload (Mirai)", "value": "560870876fb92d2124a11660e095bfccf9add252", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689797877, "uuid": "e166b794-7308-4f6a-931e-99ae5f218827", "comment": "Malware payload (Mirai)", "value": "ac783bf32e8cdfbf34a514ff621cf9d9240d0a26bc3d5114576bd0bde949b13e33e16ce26f848575f3428d0c7f1cb73f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689797877, "uuid": "3d504172-9d54-4c01-9e2c-2e118d367d86", "value": "T181539EB9C4E8ED98C6684578B714C93DD723940465D33DFAEB46CAA7800BAEDF0097B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689797877, "uuid": "5676144e-e726-410d-a233-e1e7a02e1c21", "value": "1536://BMsvJvJabwtlw3bqSsH6aOIy/Cfs32j/JQZI1qhC8na:/JMSR893O6aO+f+uWZIYhA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689797877, "uuid": "67cea6e3-f394-4036-9a64-39f8bd2f1325", "value": 66368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689797877, "uuid": "25b7a0e3-1e49-4435-a17a-76d38c78a7ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689797877, "uuid": "fa26bc59-4a6e-416e-8b8c-ce9f340ecfa7", "value": "ca328f03c9e7d19d4cb1ec98843cb5bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e7783fd-262d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689768625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689768625, "uuid": "bbfc1658-c4ab-430c-b85b-b5c85e35d086", "comment": "Malware payload (RedLineStealer)", "value": "d81aa4ccee715ec0d0a1fdc6200133b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689768625, "uuid": "a87e5944-4ba0-4217-8296-381c9248b533", "comment": "Malware payload (RedLineStealer)", "value": "ceba0f9577af3c795c116523090c41f9fd95a64a7fc63e8d77c6afe76bc63d80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689768625, "uuid": "9f550597-0e6e-410e-a863-c53a39c6a9de", "comment": "Malware payload (RedLineStealer)", "value": "ec9c33d98641d3cf61ccf81ba2afe2307cfc1ba8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689768625, "uuid": "13a411a1-fb1c-4204-8a37-2922d87e2a37", "comment": "Malware payload (RedLineStealer)", "value": "3006bca9bafb3eb33ff51d74a96094dc1f4fde8c228870e81503185f3802a6b157aebedcfcb6cc0bbbd9559c9aa94135", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689768625, "uuid": "a2f1c3db-3742-4015-b553-76dfc623cad8", "value": "T187840113E7E89172D5B01B7018F713D30B36BCB24E74866B2B45A90E1D73A90A935B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689768625, "uuid": "3c8f4987-fce9-4948-921d-ebddc4f6944b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689768625, "uuid": "d7f8401e-8c94-49f1-ae8a-1f292f8b2303", "value": "6144:Kyy+bnr+0p0yN90QEZHvPyePlphdgPlVo8v9a+PtFDoKjFM:uMrwy90/SePlBqrLA+LDoKxM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689768625, "uuid": "ff6b8fbc-6713-4bfe-805f-30dc9ba53549", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689768625, "uuid": "fcd8ac59-1c30-4a44-a894-b1e80aa4e48a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689768625, "uuid": "b7fd3488-4671-4c9b-95cc-28d2d84dba72", "value": "d81aa4ccee715ec0d0a1fdc6200133b4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a906731-2628-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689766525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689766525, "uuid": "0b7a1a68-308e-4d09-bf15-c2258f8eac84", "comment": "Malware payload (Amadey)", "value": "23ce47783e241446f6c0ec7e33d8e709", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689766525, "uuid": "fc829969-498d-41f1-9b54-758b97ea1338", "comment": "Malware payload (Amadey)", "value": "cf90d774faa53f828a5c0c7fd9b7693ab9e6a5b59349863524aae5284b993f01", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689766525, "uuid": "e4674bac-a2cb-4ac0-8f69-eff77c73bca7", "comment": "Malware payload (Amadey)", "value": "866efc7de0880429d9ea6ba5d691401e0005e3b7", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689766525, "uuid": "5076322c-ee25-42a5-88c9-15d3921ea317", "comment": "Malware payload (Amadey)", "value": "105751ca263795a58303d37239b522d996bac9d1f4c11d3117e626365b951d65720999daa853dac5d45d5f5d13d997ce", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689766525, "uuid": "3a510d4e-15a4-4b19-a44e-a4957293523c", "value": "T14684F142A6E89133C9F5177068FA03834B357C929A78976F2345E85A4CB39C4F53277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689766525, "uuid": "1f8df898-a64b-4e45-ad19-004b37f1a6e6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689766525, "uuid": "e42021a9-0d1e-493b-bfc0-a0452e1740a5", "value": "12288:tMrMy90bKGAGuZhqDSqJCo1zBxA1PSezdo0rrk:ZymyhqDkif4S+oF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689766525, "uuid": "64a81c28-6b58-4e81-885a-5e903669fd4d", "value": 399872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689766525, "uuid": "ebdc8a64-e12c-4911-a846-161a1e5d0be7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689766525, "uuid": "d363d829-84b0-408f-a708-0ed299a40504", "value": "23ce47783e241446f6c0ec7e33d8e709.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e697e5fe-2665-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689792959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689792959, "uuid": "87b7548a-cb41-4394-93a1-f80cb60d3863", "comment": "Malware payload (Amadey)", "value": "2993a209322f7d93406fd78632f4a545", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689792959, "uuid": "bed71c34-3580-4cd3-88df-0eed0477500f", "comment": "Malware payload (Amadey)", "value": "cfdc6cd562d69f4233d6d8bcde44d4bd5e6825bd17383e6bb2f76b9fd006ead3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689792959, "uuid": "13ecdde0-2f6f-4008-af74-f6ae5c595d27", "comment": "Malware payload (Amadey)", "value": "e141503a5dc185ee91e131b8404ee5f563ff1cd1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689792959, "uuid": "a2fe2407-fc1b-4110-91a3-0c7807f802ca", "comment": "Malware payload (Amadey)", "value": "51bee7aad92e09851cc8750a9be3caedc79d35e7711be619b0fc45d7e7659d279ec075c581597f7f628b6abf19aa5bd1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689792959, "uuid": "8b606d0b-f524-4816-99b1-975247b37943", "value": "T151B40243FBD49032DDB55BB158F607D30A36BC928CB4836B6285AD494D73A84B93236F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689792959, "uuid": "1c3935c3-b1b6-44ab-8ccd-ba064d8f5357", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689792959, "uuid": "52e1a429-bb83-42dd-acc2-fbc0d2a0faa0", "value": "12288:cMrzy90i9beiGTgODcYq3pB/npmVb66azq:vy/bhGT5Pq3Lhm/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689792959, "uuid": "019b120a-0452-43e5-9b60-33a89f82c2d7", "value": 526848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689792959, "uuid": "e0ab3180-f3c2-4f4b-bda5-11511b6e0b3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689792959, "uuid": "6d731b4c-5adc-49ae-9464-df0242970e80", "value": "2993a209322f7d93406fd78632f4a545.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff52acbc-2632-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689771096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771096, "uuid": "d1f01ffb-b974-43cd-bd1b-e9c768d60c5f", "comment": "Malware payload (AgentTesla)", "value": "d8b399efb97cc74e226421ebcd69c765", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771096, "uuid": "ac111e03-d44b-4eb7-80a2-9b780065af98", "comment": "Malware payload (AgentTesla)", "value": "d040c85b30bbd2caf9db04bde4605cfbf6fc5f3e9e3aa27ad6aa115721d47137", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771096, "uuid": "6995c7f4-ff05-429a-9e6f-2a00129cf1ad", "comment": "Malware payload (AgentTesla)", "value": "5521553b5dce6892e4afaf3f6e6cacca5e3972ad", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771096, "uuid": "f08853f3-33a8-423c-9528-9120ab5c133d", "comment": "Malware payload (AgentTesla)", "value": "37fbab905fa0e44caaa87e3ff4ba1c1618a9069472d3bcead64bb9b0ea2921f695d651df01d0e0eb5f0020913449c46f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771096, "uuid": "fdb99538-f103-4c0e-8d6b-6d1761062a82", "value": "T1CE13D25AE39F0264CF5112B6231B4E89AABCB23EB35054B234AC537433EDC3D46665BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771096, "uuid": "3195c5a3-823e-4ff0-9943-3e92b9034c30", "value": "768:uFx0XaIsnPRIa4fwJMp81bYhrN/vzJ4xx8n2C23+d:uf0Xvx3EMqpYV1LJqxxM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689771096, "uuid": "c9b59001-5a06-40b9-a05a-e96d1bdb0952", "value": 44604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689771096, "uuid": "ef0c1e6f-2898-4ff4-8c50-7c93eae8d9e6", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771096, "uuid": "c9d1de53-0af2-46d3-9475-8392cf369ec5", "value": "d8b399efb97cc74e226421ebcd69c765.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7ae66f5-2665-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689792961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689792961, "uuid": "d15a562b-a3cb-4ef8-b9c6-467c27d9e1be", "comment": "Malware payload (RedLineStealer)", "value": "0ee61794cf7e5502cf233be168d461d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689792961, "uuid": "ae035fe9-0563-4db8-82e7-20cf70840454", "comment": "Malware payload (RedLineStealer)", "value": "d134576ca7416e71db7bd5aad43296de284dd20154fd0784d9bf45d27603fc48", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689792961, "uuid": "8db87684-aa7f-4001-9450-0913194fcafd", "comment": "Malware payload (RedLineStealer)", "value": "eaaa82aad6309480ea83e8ce6bc8ce19f52e3bbd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689792961, "uuid": "93565d1c-76ab-4dbb-b5c1-0609893312b4", "comment": "Malware payload (RedLineStealer)", "value": "5f5a29f20eaf514018e56e7ec2ccd62f4213b7b528d2cd13bd0856694e9c5f0dee7327f7b7b6f8b423148c3d1a9cbc66", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689792961, "uuid": "72c471b8-4696-4c8a-8c31-cb7bf54ab7ab", "value": "T1EB84F113A7E89032D8B51BB058F706C30F39BCA29D78836B2795684E1CB3694B57177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689792961, "uuid": "d3594cbc-ef8a-4ecc-9a2b-401ba8979292", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689792961, "uuid": "c0d53999-7320-4394-b3d6-40946fd4cb1d", "value": "6144:K4y+bnr+Mp0yN90QEQw4t9gTwevTqZFJTTSCDW7fqgfjr7f:oMrsy90z4t96TqrJzD49rD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689792961, "uuid": "f0c662a6-cdff-4e72-b369-592504057a91", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689792961, "uuid": "06c8ed5e-a72b-436d-b058-a165c9aa6a68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689792961, "uuid": "7c87fa41-8793-4db2-a66c-e6f3b230798f", "value": "0ee61794cf7e5502cf233be168d461d4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f421235e-2665-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NetSupport)", "timestamp": 1689792982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689792982, "uuid": "6bdc3d09-b69b-4fc9-940e-732ef148b796", "comment": "Malware payload (NetSupport)", "value": "44c7822ba8533955e01b7f81e773fe05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689792982, "uuid": "a31d349e-f89d-4855-a0ff-741d11973f5c", "comment": "Malware payload (NetSupport)", "value": "d1cbdab3bf09c371daec3e49d5422bbc62df1bdd98f073148d4abcca57d3e7c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689792982, "uuid": "f02a5e7d-3eaa-4524-bfee-dc881969406a", "comment": "Malware payload (NetSupport)", "value": "fbb531f50cdaa6a5fbb422f8081b800674e3577a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689792982, "uuid": "0ff91d25-c4bd-487a-a8f0-f867ea995b48", "comment": "Malware payload (NetSupport)", "value": "6ea66f12797649b2dca1ed533cab5eb05437b5fbea93335067f8e66e5a944b2d4a68f0148e54a08b051e0b23c82f7b8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689792982, "uuid": "c5e2cf62-35e4-4070-9294-7fffebc2b68a", "value": "T196E5164221CC0181DF367134B6AD3AC5D936E4E80F2849EB7FB0A5D55AEFAE227F5214", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689792982, "uuid": "479bd809-177a-4fa0-99a0-039ad57c87f9", "value": "89eab693f0f3c2fe22cf3cb16348d315", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689792982, "uuid": "0ea28b41-52bc-4bb7-bc1e-017819ee0ad9", "value": "49152:lxl0H13A3ydeHyWm2CHI145+7IqvP+EJW:HodYRAI1oUIwP+OW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689792982, "uuid": "cdf2758e-37c7-41e2-b7e0-71edbe179771", "value": 3296392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689792982, "uuid": "0d23e6a4-1ca2-4de7-bac7-a7de0a52de00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689792982, "uuid": "9297e126-b65a-4d17-b447-efea559589fd", "value": "44c7822ba8533955e01b7f81e773fe05.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3bea4d5-2683-11ee-a6f9-42010a9c0055", "comment": "Malware payload (LimeRAT)", "timestamp": 1689805866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689805866, "uuid": "4425cb78-794f-4f02-af31-cc42ba59bc5d", "comment": "Malware payload (LimeRAT)", "value": "7bec74560ef5bbe652f3630ffb333b7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689805866, "uuid": "683889a7-624d-4ed5-8ba0-947c0928e458", "comment": "Malware payload (LimeRAT)", "value": "d1e23942effbdf831fb99ceb19495a5338fbcf2872a6782c58b184b4b2b33c4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689805866, "uuid": "e658f0d6-25e1-4628-82f1-e8c81d91274d", "comment": "Malware payload (LimeRAT)", "value": "75985bc0077841d1be4369cdc2715662e6266811", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689805866, "uuid": "592f1a1d-65fc-4b1e-a161-3eaa93078ae8", "comment": "Malware payload (LimeRAT)", "value": "9528fbd15c824a3afbcaa4296f1f8890cb70c22da24be5a95fb5147b35d59f764985de654fddd9ebcb7fa38770c42d2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689805866, "uuid": "c514b28c-57d9-4e64-99f2-2561b21b492f", "value": "T16775697CDAA65626D4825CF41E73986B74F48F11A4BECCB27C0E187AD1FC444AF2B126", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689805866, "uuid": "c9ad579c-1903-48ea-aef7-805033676026", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689805866, "uuid": "b8ef606a-3737-4dc5-bc3e-6f5d2dcc8228", "value": "6144:r66IzOEQkI6VRkdzlaWt56cPziyrBC4AaibAL69:rbIzOEQkj8laWthvr84PXu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689805866, "uuid": "7ff60479-ede2-428c-b3bd-73fe4e3b1476", "value": 1674240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689805866, "uuid": "01827539-4f5a-4378-ac1e-6e1562ea72d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689805866, "uuid": "f4f7ec87-3912-4203-9efe-93481d30f6b4", "value": "7bec74560ef5bbe652f3630ffb333b7b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53aa567f-25e5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689737737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689737737, "uuid": "16281fa8-6e5b-4bbb-9c06-1284fb1c7ce0", "comment": "Malware payload (RedLineStealer)", "value": "17eab25e21c2ce7b5f468b3605d4d575", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689737737, "uuid": "c3320fea-9eb8-43f1-8cce-1ec562e47377", "comment": "Malware payload (RedLineStealer)", "value": "d226753ac982a76728ad05f2970c3cac2a015fe07ac3c5472a457d9c6792b3a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689737737, "uuid": "dd2a61ba-7a0e-4cbe-a69b-76caa3ee913c", "comment": "Malware payload (RedLineStealer)", "value": "0c4a2d8c386936b0a81e5aca4a5faf486db1f96c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689737737, "uuid": "4a778878-753e-412c-92cb-6d8325f21339", "comment": "Malware payload (RedLineStealer)", "value": "e458f107d5da6bb35685806141e662093cc9ee3dd9594ceb4fdada1ea654a7670ccaa318fee6b028bafbed6be2028245", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689737737, "uuid": "06a12dfd-1bc0-4e12-9131-ca3524c8691e", "value": "T13E04D558324BA57ECA7F883D9C700CE0677CAC665246AB078D8EF4E43D3A7919E051F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689737737, "uuid": "0f2ef056-1830-4975-8067-f03312036027", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689737737, "uuid": "b6838ba2-11f1-4032-b764-daef183c4c20", "value": "3072:cMC/Huw6uatUGpExN8aOqcJ9Fw/8e8h9:cK1Uef9DFw/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689737737, "uuid": "b4249170-df3e-487f-b62a-0b35083e17c4", "value": 179822, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689737737, "uuid": "c484c21d-d2dd-442e-9839-3bd0e4785d5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689737737, "uuid": "91721fe7-b71b-4e17-9f97-6dc2ca72ebe4", "value": "d0328503.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7318d2b7-25e6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CustomerLoader)", "timestamp": 1689738219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689738219, "uuid": "fd6fe8b1-d7d2-4b62-806f-8b6ed4626e2b", "comment": "Malware payload (CustomerLoader)", "value": "9ccbdba7e4d2299ca977d2695394dd8e", "object_relation": "md5", "Tag": [ { "name": "CustomerLoader", "colour": "#57A5C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689738219, "uuid": "17516aab-5faa-4afd-a872-10683fb2ad89", "comment": "Malware payload (CustomerLoader)", "value": "d35c36d62c69cfca62a0f7183ffbeda6ea48db9b647b1338e2e27f340ddf61c8", "object_relation": "sha256", "Tag": [ { "name": "CustomerLoader", "colour": "#57A5C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689738219, "uuid": "7e0c6350-9051-439b-a4a9-2b2fc17d25d2", "comment": "Malware payload (CustomerLoader)", "value": "868958ae664bb694742d8450b7b4ff1fc3634d0b", "object_relation": "sha1", "Tag": [ { "name": "CustomerLoader", "colour": "#57A5C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689738219, "uuid": "4f120b64-32ae-4ed2-acd0-81431acff872", "comment": "Malware payload (CustomerLoader)", "value": "dbf087eb0c7a8aa3dc49f6f12f27b7fe78c26f5e4706cfb1a5e55493d33bb0cd390e970ea60593b9e1208cefdd0fff22", "object_relation": "sha3-384", "Tag": [ { "name": "CustomerLoader", "colour": "#57A5C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689738219, "uuid": "e73c271b-ad6f-4bad-8629-24d38c1fea1e", "value": "T18E03D00057EC42B6DA671BBCDCE2024216396F67E467DF9BAECC558A1D13329A333760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689738219, "uuid": "025c5c12-3d05-4d84-953d-f35dcd83939b", "value": "768:QlnpUJmju+yDa3M2F7Tllmu24Ra2DovIieNhIPVQPaIjKQ1:5+g2JTll92m7ov0oWh/1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689738219, "uuid": "eef38ae9-a243-4715-8c86-704e4051381e", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689738219, "uuid": "727951a3-388a-409e-8f04-bc94c9e8c61a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689738219, "uuid": "667312a4-1321-4434-8b83-dea68e46ab41", "value": "PPErrNhFtZ3NdVrfhZ1ddnAk.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "652fe86a-2601-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1689749792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689749792, "uuid": "5aafdebe-8488-4420-94d3-d36b9657019b", "comment": "Malware payload (DarkCloud)", "value": "12864f3dc3fbedfb22b049d0b7ea8958", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689749792, "uuid": "c7f6df24-d7a1-4cd0-a659-8da468619f76", "comment": "Malware payload (DarkCloud)", "value": "d363a0101122b51e0bf68805358b28d087a616ebf04d666c6182fc6549fc8a22", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689749792, "uuid": "03b013d3-157e-47a4-8a25-0f6941f10eaa", "comment": "Malware payload (DarkCloud)", "value": "4a1c9ebbb80c2a2dad0aa39effd8258184f8cbfb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689749792, "uuid": "f0d3c3a1-beb6-47e3-a7a9-6575ad472065", "comment": "Malware payload (DarkCloud)", "value": "30642cfbe0c5271466d2e847fd9c15e5e79ed4882b1f3bf1cf8c4eee75a6e959cf8d29ad923bf86673dde0ea04020d94", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689749792, "uuid": "db4d5dd7-13fd-4ee8-92e3-22ed04a0b5bd", "value": "T1DD9422006BE1E17EFCC783352FA676255EF98454549823035F628F047A62E879E0FBB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689749792, "uuid": "004351dd-c78d-4a65-a9f9-32779b36ff61", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689749792, "uuid": "524bf4d1-e9e4-4818-b461-b866541ef472", "value": "12288:vYJCgAZBow1kBbvWC0CCYlpVssLtqVs0OlpxX:vYJovahvWC0CppVDLtqujpF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689749792, "uuid": "6b4e878f-46a8-474f-8107-44297f553931", "value": 443029, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689749792, "uuid": "4bf04eed-f3ce-4dae-aa49-edcc6a529d8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689749792, "uuid": "3336d790-16a8-4d64-8ae6-fa7fe9d63ee9", "value": "12864f3dc3fbedfb22b049d0b7ea8958", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0cb1c45-266f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689797164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689797164, "uuid": "24639967-4d15-488b-a02b-fbe5f6a85bf3", "comment": "Malware payload (RedLineStealer)", "value": "05ef3bbb9be3915491e22c172659ad8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689797164, "uuid": "dd6bafc7-c96f-4d91-ac40-649a34bf0a3b", "comment": "Malware payload (RedLineStealer)", "value": "d3b1147c15eca7914aae5aba85cd1a2c519c09eb52263df56e67d45918297dbf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689797164, "uuid": "1baa5591-0ff7-4922-a4fc-389569aad002", "comment": "Malware payload (RedLineStealer)", "value": "65e2ac399966aaea46cfdcb2b7b3c2df3baacb95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689797164, "uuid": "63ec58ff-dd7e-41f0-b58b-36323aa1b312", "comment": "Malware payload (RedLineStealer)", "value": "5cc3051cbeb448937abb30c4d545e7b23b42f3c9cd47b3d3d73960d89aea9543914c5ff2ca1ea7da49fa961a7c4bbcab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689797164, "uuid": "1e48a0c6-6e2d-48f1-8694-1bb259bae83e", "value": "T1A4840142F7E881B3DAB0277018F702831B35FCF19E75866A2B82594D0DB2A90A53577F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689797164, "uuid": "bab0ba74-55fb-4378-aeb2-67ebd52455fa", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689797164, "uuid": "564c3cbe-5f21-4ee0-bb5a-a4300f01b7c0", "value": "6144:Kmy+bnr+8p0yN90QEs4O9CG5KHdr4B3xtyzqxXzfL93d18GtDdIpWupPLNssoPau:yMrgy902MJ49x5x1rY1DNdoPsXSea", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689797164, "uuid": "648011f5-3aa2-4ce5-80e7-ede5e81c0051", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689797164, "uuid": "0445a983-72af-48a5-bdf4-09b27d08fd06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689797164, "uuid": "87491cb7-45e8-4bba-bfbf-af49ea240297", "value": "d3b1147c15eca7914aae5aba85cd1a2c519c09eb52263.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1517c67-2657-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689786937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689786937, "uuid": "f5f3a7db-4f2f-43be-ae6c-149227fc0697", "comment": "Malware payload (RedLineStealer)", "value": "42e42ee1b3615caa45bdb9999642067d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689786937, "uuid": "2bbd089e-1749-48db-8ef4-fc3f006ada6d", "comment": "Malware payload (RedLineStealer)", "value": "d3c8faef1fc611343ee8bdd7462c6c9e0b90394da533475f46a518bb2c63329f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689786937, "uuid": "c61add7e-646a-4eb4-8bc6-43408f15de0d", "comment": "Malware payload (RedLineStealer)", "value": "b6b45e47765aad54175eb94920fb4cfdc574d9ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689786937, "uuid": "627389f7-9f9b-4ad3-9a41-8aadc57d1217", "comment": "Malware payload (RedLineStealer)", "value": "7b24f61dd21f6215670df1b4ad22601a791de19437b976dbcb4729b62d4d0683628c30a3366941bdd6afa4da003182d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689786937, "uuid": "405af8ca-6236-4a86-9597-d9b841871ebc", "value": "T10674F1213BB18076E5575B316831C2916A7BBC625B7102DF33843A3F6D31AD14AB8B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689786937, "uuid": "c2322f5f-4eed-4051-9d76-0adc36140a5e", "value": "6d688d9cc0f6602b42d54dce0edb5c52", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689786937, "uuid": "0dc9f459-62b8-4edf-9b57-d7b84df23b47", "value": "6144:Ug7lXfn1ieFeEx47WvJ55tp5E9s08b2/Z8a50:LpXf1pF47S1p5csni/Z8C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689786937, "uuid": "0c268ec9-1dae-4c1f-ae19-8ee77e7a1901", "value": 346112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689786937, "uuid": "7efdeadb-6919-4cc8-872c-428922bd405a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689786937, "uuid": "b6940b9f-3ac8-49f4-8b28-77bda279a941", "value": "42e42ee1b3615caa45bdb9999642067d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6178a8a-2622-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689764128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689764128, "uuid": "4106e067-a457-46af-b950-05acf3624e9f", "comment": "Malware payload (RedLineStealer)", "value": "e84b338ca711b0ebb9b61944a0ef98ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689764128, "uuid": "7d86469b-b53b-4280-b5fe-2a11d072239a", "comment": "Malware payload (RedLineStealer)", "value": "d4bdcccfd716d226f5161320cf4168b6c077e51d788d410654678cbd2e00ff63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689764128, "uuid": "10ddce1b-b1c9-447c-a3dd-d63d376ed62b", "comment": "Malware payload (RedLineStealer)", "value": "b797fc849a85fcbd8521af4d672fa63397504f8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689764128, "uuid": "06d24347-6c61-4ef4-aee2-4d7b25ec886f", "comment": "Malware payload (RedLineStealer)", "value": "6a1ba3921e5a0d491700e25d3a488ce6f7a1cc3eacccf1f0feaa3bbe37922873f711c74be6f57da32da2eb49c3ebe584", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689764128, "uuid": "4e1cac0d-8618-4794-907e-65cdcf032b37", "value": "T106840113E7EC9032D5F527B42CF612C31E36BCA1593883AB2742A85A1CB3695753637B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689764128, "uuid": "42411a2d-2f42-4f25-93eb-516f783f9f35", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689764128, "uuid": "7fad854b-0eb6-43b4-a360-d1eebae6995c", "value": "6144:K6y+bnr+Ep0yN90QEqF3vKYfnkn+cfA6MBv5yvGf+K21PJzBlxdzus+rqmTf:aMrMy90QFfzfhzBhyh9PJVdzus+rb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689764128, "uuid": "a7974828-41dd-44b2-8852-63ab348a22df", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689764128, "uuid": "7cade293-ad84-4b33-8a2c-cfa8cc018530", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689764128, "uuid": "27042956-cce2-40fe-9c8a-b2678b4f7471", "value": "e84b338ca711b0ebb9b61944a0ef98ff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "404d40d7-2634-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689771635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771635, "uuid": "2e16b6e9-db4f-499b-ad24-a15b34779574", "comment": "Malware payload (Amadey)", "value": "c09cb4ac829d3d709dc01fc43912235a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771635, "uuid": "9399b879-3948-4eb8-aaa4-f2b4831e7d4e", "comment": "Malware payload (Amadey)", "value": "d4ca621fb3de1c412bbfc2ac3b6d8882c20e22dd4f4c518ddd8ecda36ab38b71", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771635, "uuid": "b8226d4a-5b0e-4a2e-98bc-0cf6ec2c0a6b", "comment": "Malware payload (Amadey)", "value": "488d818786176e9d42dbe10244d2e24fa733307a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771635, "uuid": "9d60287d-96f9-436d-a19e-46976610ba0d", "comment": "Malware payload (Amadey)", "value": "1408e1d5d9c5eee6d1c091ba07d9c6fba3177f74036e130ead9f5f1776fc958e3bf242fa807fe7de58e4c270cd3397b9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771635, "uuid": "f62d6371-edc8-4a6e-8bcc-4e969e49954b", "value": "T1B3840112FBEC9133D9F12BB458F703831A35BCA15D38877B2659A85E0CB2490A93577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771635, "uuid": "44041da4-0f0c-4caf-9cee-5c86b96f0c77", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771635, "uuid": "b28ded81-27a3-4300-84a0-d7587bfae63b", "value": "6144:KRy+bnr+4p0yN90QEozsWKlP5vo+wQox9oj66QmOCcXdpa:DMrUy90fWKlBTwQoboOpCI0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689771635, "uuid": "0a780ddc-0f7b-4cd1-908f-a6aeb8b4422d", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689771635, "uuid": "f3aab4d5-b14c-4970-a657-123808207c2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771635, "uuid": "ffa9cdeb-55c1-472f-93de-61510c4d72da", "value": "d4ca621fb3de1c412bbfc2ac3b6d8882c20e22dd4f4c5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15cb2d6a-25cb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1689726466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689726466, "uuid": "4276edaf-0db4-4ce0-b459-6b5622ae7710", "comment": "Malware payload (DarkCloud)", "value": "29e2c66bc44a433d6da95086cae40800", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689726466, "uuid": "dc6d05cc-aa2a-4576-a6ba-2723b1770262", "comment": "Malware payload (DarkCloud)", "value": "d4dacbc0546a45d26b7b9d58836b7905a919155b4063825988500e70c739d1f3", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689726466, "uuid": "e1c9a23b-5d0d-4f0b-8926-f3253a9d4f1f", "comment": "Malware payload (DarkCloud)", "value": "e41e56533dad36409b8f9d30e2bae8c22bba11c4", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689726466, "uuid": "82c18f9f-b1a3-4428-8c39-01875005fe67", "comment": "Malware payload (DarkCloud)", "value": "1e1912c57ad88089f3b89a25c84bc193976c725aaee3078f807adbddfe8c0d2e82a02247e180b1c14d7a912fbfd6f552", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689726466, "uuid": "933123fb-49b7-44c9-a66c-0b9033bb84ed", "value": "T15EA42218D7E0C42BE87566759AB6817ACFF26A123855CB9B23149F7C3617364C30EB23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689726466, "uuid": "15d0792f-36d1-440e-9cdc-33267dd2ebb9", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689726466, "uuid": "ba0886f7-dd9b-4760-8d39-e1cded271d41", "value": "12288:PYSahmsDnOhqRKHrJUovhWmtQNdVPfUgB1X3oNtHZyLHr:PYSahFDnOkRKLJUK6d9UgGALL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689726466, "uuid": "c7852688-19f6-4159-b418-d370071552e9", "value": 462854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689726466, "uuid": "e97dcaba-ebce-4b5a-8784-4c1f0a053ab8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689726466, "uuid": "3e7397c2-d3a9-4500-8869-227b33546989", "value": "SecuriteInfo.com.Zum.Androm.1.24234.31952", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f16ad03c-2617-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689759477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689759477, "uuid": "b3ad3ae0-c13a-46a1-acad-e22d0e7fc525", "comment": "Malware payload (AgentTesla)", "value": "1782b7236df84ce58befb6e29c2ddecb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689759477, "uuid": "ae7059b7-edad-4b52-afa8-6ddc3db959e3", "comment": "Malware payload (AgentTesla)", "value": "d6325d4aa8bc6a935f0d1b136a1e791c554cb78ffc23823e9601031e6a677c3d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689759477, "uuid": "0608e8c7-fdf5-4d48-9518-af20fdb0c39c", "comment": "Malware payload (AgentTesla)", "value": "fe583fc137f63be313d85692efad3675ca873f1b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689759477, "uuid": "47dcfe8e-729c-4f9d-9a9c-ae9e51efba26", "comment": "Malware payload (AgentTesla)", "value": "39bcca13e835a680b0e705f43994dfca6a26820b08e6cc77b99998fda0b8c3ffb49f5fc727c9024c9dbf20c9fad9289b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689759477, "uuid": "30e63722-4f14-41a4-b440-07df52ad637d", "value": "T117E4121439A89717C5A0CBF94260AB0563B69FE865A1F11DCEEBECC775A5F041F80E0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689759477, "uuid": "3bd4145f-de7d-40f8-8587-e9c114ac528a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689759477, "uuid": "02102c84-3dc4-4c6d-abdd-a04103c8eac5", "value": "12288:fqPYPfY7JLlD7MtOwndshtpNt/azlbud4B3v3tjWh/N/v2H:SPYPgbD7MtTdsPpj/sbud8t6zv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689759477, "uuid": "93cf484b-dd58-40c3-ac05-3f94647b04cf", "value": 678400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689759477, "uuid": "eaedbf03-c854-451d-93d5-17f238b31501", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689759477, "uuid": "83897597-be90-4051-affc-356b198f733b", "value": "RFx_ExxonMobil-Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02d36564-265d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gozi)", "timestamp": 1689789141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689789141, "uuid": "f7d437d9-d94e-4e4c-84e9-e07815d1f0ad", "comment": "Malware payload (Gozi)", "value": "7f4e427936de0eecd46ce643bf5c0d36", "object_relation": "md5", "Tag": [ { "name": "878155", "colour": "#FA7EE1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689789141, "uuid": "991ed92a-71d4-4da5-a262-e56fab6ac9ab", "comment": "Malware payload (Gozi)", "value": "d66f5288a48f0e4e35601236c1521ac742420c3e127b11aa190fc54b7ad85ad5", "object_relation": "sha256", "Tag": [ { "name": "878155", "colour": "#FA7EE1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689789141, "uuid": "3eef064a-3a65-4098-a80d-7c0ee98352f7", "comment": "Malware payload (Gozi)", "value": "d912c978f83f0eed11a70eaaccc79543af5d7ccb", "object_relation": "sha1", "Tag": [ { "name": "878155", "colour": "#FA7EE1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689789141, "uuid": "932aa8ec-cad0-4824-b673-b34ff0e55075", "comment": "Malware payload (Gozi)", "value": "26ea4570ea74d2cb18aa693fcf9cdda4a53c43db10a112d780fa21e2f5e6a85d9d03eaff390692c737b7643dfa6e8759", "object_relation": "sha3-384", "Tag": [ { "name": "878155", "colour": "#FA7EE1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689789141, "uuid": "de736d95-74b8-4fce-889a-2acebeaee64e", "value": "T17A757B03F6578BF2E2A91B36DA9B18048365DD83731BD70B788A23D755233AB9CC6507", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689789141, "uuid": "5d577771-c0c9-4b7b-9971-35b06f4897ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689789141, "uuid": "529868e0-5d3f-4de8-805a-c8a97a2cce19", "value": "24576:Lqy2xGQm4hQgFyf6eQoez4SBylteu8Kd6mNIlQtZT2/jvemgB4toFv0lk4HcWNCI:NMy8Kd6mOatZT2/jJ0wovQfHcWNCI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689789141, "uuid": "ad346036-4f36-43a2-b865-bf0616f17904", "value": 1628936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689789141, "uuid": "48a193be-90ca-4ba0-8aaa-ac0e2845fc9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689789141, "uuid": "4e9943fb-f31d-4c85-b540-47671cf27d6f", "value": "1m9SiKSPDk41YBI2wVIax0JCDD4SexGqGQ-FS3rYWtU.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "722c48f4-2638-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689773437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689773437, "uuid": "b65962b9-e32e-44df-8522-eb55fc9e45ca", "comment": "Malware payload (RedLineStealer)", "value": "bcf3bf79ffad508d0c6614b13a236386", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689773437, "uuid": "ef8f7337-732b-4bb4-bdb5-76aacae7a699", "comment": "Malware payload (RedLineStealer)", "value": "d7873c75af8bf0f44eedb5171fcab5b70d157578f4a43aff8aaadb23058cb1a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689773437, "uuid": "14a6fa0a-afc0-4a11-a97b-1dbfee6011d1", "comment": "Malware payload (RedLineStealer)", "value": "b6123c6da65ce8c9f1d79f74e9b6f2da2a3db14c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689773437, "uuid": "b2704800-1c4f-4287-bb0c-aa7850fec774", "comment": "Malware payload (RedLineStealer)", "value": "1a9b713754ead4354086a6eb2742f72996f9fb5050c4744099d2f6706745f934cc08d74c3779eb4e89292fa4a31186f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689773437, "uuid": "9f6c931f-4e23-4dcd-9b7d-ca9e56e8ec4b", "value": "T17284F152FBE88432D8B627B018F723C31F3A7DA15D74937B2285994E1DB3A90A574327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689773437, "uuid": "8d3929e3-e8ee-42ff-95f3-de4564fd2248", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689773437, "uuid": "ff8354e7-f356-4262-86bd-3768b82deb21", "value": "6144:Kjy+bnr+fp0yN90QE7c7Yla5bG+YvzSs5TpZ+xGYXJfcCcHnlRHuhyGXBcW:JMr3y90BsYlGFAzSk07JVcHnl94XBl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689773437, "uuid": "f8fd2c1e-c84f-4858-8218-4e187cd1cc8a", "value": 399872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689773437, "uuid": "a75b6cda-0ffb-44c0-821f-4b9f89e5cad1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689773437, "uuid": "288f3759-f69b-4c1b-baf4-d0d34a58813e", "value": "d7873c75af8bf0f44eedb5171fcab5b70d157578f4a43.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06f64aa5-262c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689768103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689768103, "uuid": "74e2c7dc-202a-4a7b-94c9-743df59745ab", "comment": "Malware payload (AgentTesla)", "value": "0f117fd5a549922b60f51c2b24104227", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689768103, "uuid": "918879c2-2d01-4401-9767-10884b45261a", "comment": "Malware payload (AgentTesla)", "value": "d7c7c435f1a15f42c22996c857678fd5d4e9618b1ea9425900da123506d0ddd7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689768103, "uuid": "83fe7302-4931-4ca3-8b28-b2036bf82595", "comment": "Malware payload (AgentTesla)", "value": "0192128d003425c376b43ee2c68479bbc6973026", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689768103, "uuid": "7e24e37c-e10e-4402-99f3-6171aed7a805", "comment": "Malware payload (AgentTesla)", "value": "1b3ff3d7eb11b4d3643ff815598dbbc3eb6bb94eb0d566cc38b94c8f689761c6244283f7c3e16dbbb6a8f9b90d268bcd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689768103, "uuid": "01d919e1-11d4-429f-a9e3-9f0e2364452e", "value": "T158D4121029A48723C5B4CBF903546B4113BBAFDC28A1E52D8FEBECC3B5B4F564A4495B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689768103, "uuid": "2c02afaa-260e-477d-b22a-2e66144120ca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689768103, "uuid": "93b8b5d8-0696-4614-bc52-a6df0ee3ad54", "value": "12288:SIPYPfY7BRttxJOwPlEj/53LTjG9ew9avWEgjkc:HPYPgJtxJOKEjB3/aMw9Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689768103, "uuid": "96a2864e-8de2-4f5a-86f8-8330c25de391", "value": 644096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689768103, "uuid": "ea98b4da-4023-408d-b698-69860302cb05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689768103, "uuid": "62e3391b-87bc-4cdc-a7c5-ca38a636e841", "value": "EdMKlRedZoZMv2Y.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a775be2b-2656-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GCleaner)", "timestamp": 1689786411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689786411, "uuid": "3fe3fa34-bb36-4594-8624-2e0dc5de5a7a", "comment": "Malware payload (GCleaner)", "value": "443f461dbdc23dc816cb609a5f5652a4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689786411, "uuid": "27524bcb-b564-4ad1-bf90-deda65fab241", "comment": "Malware payload (GCleaner)", "value": "d812715e914b3592fefc89034f10db6b5f69a80566289f616fcb05e8cbe6bc49", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689786411, "uuid": "131d0ef2-06f4-42e7-b8f7-5745ac47e758", "comment": "Malware payload (GCleaner)", "value": "e3c672e54a62775d41e260cd76fee05e2fe2db10", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689786411, "uuid": "199560e0-58b4-4be1-a228-f3a9ca838449", "comment": "Malware payload (GCleaner)", "value": "fe6bade9a504378c5e4f07541cec77f84880de2142c49b56f2ca2ce8b4fc15f661c5ac43f42f2e796645c9f54390357e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689786411, "uuid": "8964cc24-4a41-4405-bd6a-a77d72365ac8", "value": "T1BB74E12136E1C072D5A73A300572C6622BBBBD716B7451CB37A83A2E6F312D11B74B97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689786411, "uuid": "0f8175ca-c531-42c2-8f1a-a6c46a3ea5ff", "value": "b64d2f93bd8f1bc9d27e80e5b6c25b2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689786411, "uuid": "90f8a61f-4a7e-4b4f-be9d-0070c4041b53", "value": "6144:j+qQftbfUZ1yaIc8C0XGcU9N8+HYHM3Ut/ioYmhqG3lP:oftzFc8n2cU9THCM3UbB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689786411, "uuid": "ac9e1f57-d571-4ae2-903f-9437d2dc64e3", "value": 345088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689786411, "uuid": "8e59c2bf-09cd-4e66-9a5f-5e6d50652958", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689786411, "uuid": "3a82533c-dcbd-421a-8bf5-4afceef50a45", "value": "443f461dbdc23dc816cb609a5f5652a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10c30ca2-25e5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689737625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689737625, "uuid": "e880c257-1a23-4bb1-817a-77afebbd059d", "comment": "Malware payload", "value": "1c51405e588a5b2ffef997bf2d2e60a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689737625, "uuid": "f771f2fe-0e16-4e4e-9242-479be134d74c", "comment": "Malware payload", "value": "d81975e6928bab57ee1e4aec83dc6e87e19fb2155ad92e21c36fe48dfa79d641", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689737625, "uuid": "1b61a798-8d2f-4f02-91ae-f07eb63eab55", "comment": "Malware payload", "value": "eb427b4c99e7eaa6c707d6ff6895b510690dc6a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689737625, "uuid": "22f314c8-5a1a-487d-9ec3-d3ee397ce092", "comment": "Malware payload", "value": "984517cc659e16c6c0ab1389ece21f6feb484dd57e2a7deda6a6bbfb1aa56b5966fdaf26601754ac61e60ba3a98afc68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689737625, "uuid": "33398937-da33-42fc-98bf-3e3da6fd05ea", "value": "T12E95230179C08AF1E02634735F261F60D57DBC206F66CAEB3394192ECE664D15B36BAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689737625, "uuid": "3ba8a192-c18e-4f6e-8a9f-290bb9084bcf", "value": "aac51396886833dc961fcd7aab7711e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689737625, "uuid": "a62a25ee-e5c4-4d81-b957-bba34fd94ddd", "value": "49152:zeweFLpaQ9xvcJO3bRtYtY0a7CEZnCYUc:zneFhWauY0S9Ce", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689737625, "uuid": "b834c596-5f0c-4dee-aaef-7cb469e3c5b6", "value": 1902747, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689737625, "uuid": "c59c704a-6887-474c-ab58-becc23bd7bc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689737625, "uuid": "35289c6b-b769-4388-9aa1-a4a5eb548d44", "value": "6zfAiYDq3alfpMjByDJSwPCR.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c061ad1e-2615-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1689758535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689758535, "uuid": "2676ba03-bab5-4122-a160-1d0346c7b8fd", "comment": "Malware payload (Formbook)", "value": "f30ceb259770f1610b1a260eb8ace7fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689758535, "uuid": "ec3d7064-107f-40e2-b660-3ef3fd74efa7", "comment": "Malware payload (Formbook)", "value": "d8df70587d4b8949c88b3eb4324a66ac4b5b8ce9ea8e236c599431263069aa85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689758535, "uuid": "67a63c88-997a-4905-ae0d-4b54ec0e6c4e", "comment": "Malware payload (Formbook)", "value": "52acc659712baef11861eb17c3426f4868d4a4a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689758535, "uuid": "b933e152-3b2b-4a46-b76e-69b600e1865c", "comment": "Malware payload (Formbook)", "value": "3b2059dd738d2a3fc2a67f684ee0acc0142e0601257066e74afe99d733205e06f8cfbfb93ae97a4f20bb56b25fb65a8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689758535, "uuid": "15f984dd-7f81-4e40-a120-5c4a5447105d", "value": "T136541234B69590A3FCA127314EBB16076EE6DD3214980A1B27A09B9D7C776C2E417B33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689758535, "uuid": "2fb7245f-96af-4aa7-8a6f-22bd2a46e004", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689758535, "uuid": "659e7607-00c5-4b1f-bb0d-bb9c428c0db0", "value": "6144:/Ya6F9TqqF+fVNjLnpSqTSE6JdgdehxYwSbZOPPYBkgom:/YX9TqC+tZL7TSE0dEQxYweOHIlom", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689758535, "uuid": "64edeb1c-85c6-48d8-8190-630587445bc9", "value": 279875, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689758535, "uuid": "1f96582e-6dec-47cd-a260-d8a562df51d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689758535, "uuid": "d5905480-d168-4cac-bca1-b3b93b716332", "value": "Swift Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87e20737-2622-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689764024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689764024, "uuid": "9a2bcb1f-0940-41c6-8cd4-53c8af8cf257", "comment": "Malware payload", "value": "80f6c19942e8a1c1efeb6d1c4276f1d5", "object_relation": "md5", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689764024, "uuid": "14297cfe-7a6f-40d8-8187-0b4f382d9cc3", "comment": "Malware payload", "value": "d9295e5c9719a956c5987b996d7e5ef195886dfb890756d9d014199dc2bb53aa", "object_relation": "sha256", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689764024, "uuid": "60e12d5f-5c6b-4124-96b2-b12518ffa2bd", "comment": "Malware payload", "value": "da13036e9cb02ada389915924f8db4862130bf9b", "object_relation": "sha1", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689764024, "uuid": "b6ce48e4-82c3-4c5c-ac4f-2fdb18997314", "comment": "Malware payload", "value": "4cd49de084a7de2bc1c17ce4131874a4b46849f27cf99d6c4f7dacf2e232435b19cdd4b7b7552132c960501be4b33930", "object_relation": "sha3-384", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689764024, "uuid": "d28d36fa-8e3b-476c-9e3e-41e99246576d", "value": "T14AC02B30823EC1BAC0274409440C8D7FEC431044151ECF3003F42549ED5702C9E4E1D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689764024, "uuid": "1064718a-0c1e-4473-a2be-5c7c9d2bbfc2", "value": "3:HRAbABGQYmpVTjLgXKEgJffSNe1YSo/QJ8T/dLvyYesbBSn:HRYFVm7rgXfYcSoIJEvyYesbBSn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689764024, "uuid": "7160f74d-bd3c-4162-a72c-7a442d93499c", "value": 145, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689764024, "uuid": "10314402-cdb1-4ba8-90e0-f2fb18949f85", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689764024, "uuid": "a6582dbd-3420-45e7-b04c-0c34bd8afeac", "value": "Install Updater (V104.25.151)-stable url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea8166e3-2601-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1689750016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689750016, "uuid": "1f46475c-a66c-4aa0-b475-e8508e7e64d7", "comment": "Malware payload (Loki)", "value": "93379600f16d4ddd1055b3d276e98b45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689750016, "uuid": "0cb128f6-20cd-42e0-924f-e8e1f50280e3", "comment": "Malware payload (Loki)", "value": "d9a9040d06a0889e7adaf4db52a4e241e4a2b9c40c3a532c904f49cadac7bb52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689750016, "uuid": "972441b9-fe19-4f89-8900-741c7198d5fb", "comment": "Malware payload (Loki)", "value": "e642d47c607013f8ef3801a7cf42a2f2c67e373c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689750016, "uuid": "c0ab0858-3227-45c9-b20a-0798a7918036", "comment": "Malware payload (Loki)", "value": "6aefc71961fc8c6fb038f5d1247357413532fcbf198a0220422fc243654981fa12b29153e1cc4395d20287d0a29961e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689750016, "uuid": "27ba10b7-fad9-4e7e-8246-c6b1e75dc119", "value": "T1D8C41254A6858B67C0FE47B86730570053B86FD22523EA0A6FD7FCE934BB7049A50B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689750016, "uuid": "487201df-29c3-4ba0-b4b1-37e9e1fc6640", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689750016, "uuid": "b2e0003b-ccdd-4353-9710-65df5a10a0b2", "value": "12288:vPYPfY7mxfyBMoYOZgzBncKzt70poAnLT9m7WG:vPYPgKxY/YFhhMT9m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689750016, "uuid": "29cf32c3-9414-4bd3-a4db-6fd78348c1d8", "value": 573952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689750016, "uuid": "84a4e6fd-176b-4070-8707-3c18719fe6d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689750016, "uuid": "97793f11-096c-429c-b25d-3115af7e79ca", "value": "Shipping-Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9401470-2639-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689774039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689774039, "uuid": "89e222e5-77b7-4592-9349-639780575a4a", "comment": "Malware payload (RedLineStealer)", "value": "f2892fd65976de290753e37d84d3fe7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689774039, "uuid": "6c51bccd-99d5-4870-8ce6-e3ccf7e64cbc", "comment": "Malware payload (RedLineStealer)", "value": "daec1dda0c65caa2474c2e138c2116c5363aca08b9c600ee7d2718c60ddd9f5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689774039, "uuid": "889d1afb-6966-421a-ac1b-db9d6fd7d16a", "comment": "Malware payload (RedLineStealer)", "value": "d9f58fe39a7699a2b63564d6e7f2755fac07e293", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689774039, "uuid": "2a22ed41-2982-4bca-a84c-33ad23ad58e9", "comment": "Malware payload (RedLineStealer)", "value": "c8104fb63ef8580048d7acad055748cdaf6733df67aacb71ad95897d39745c6bbbc166a585d92d932ea28710333394a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689774039, "uuid": "4a4bf85b-18cc-4917-bf7c-f02a7936b961", "value": "T183840113FBE48133D8B9377028F707930B3ABDA15C79977B2B59A84A4DB1284A531727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689774039, "uuid": "e9ebd6f7-ced0-4d36-9e53-d9f2a78c34c3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689774039, "uuid": "91963f39-569e-41d3-b85c-809865e9a557", "value": "6144:Kgy+bnr+jp0yN90QEqNmci+mXwBb0nOMBRAU/TnkHRVfCM+oPFC2TS:8Mr7y90l8GwmlfLARV5+cC5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689774039, "uuid": "14e34cd9-91d5-436d-bf41-0889cd8a8377", "value": 398336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689774039, "uuid": "9cae2d68-d1dd-4456-9497-4c8f02ddb595", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689774039, "uuid": "af990167-760a-4b47-a9b4-678af2cc708c", "value": "daec1dda0c65caa2474c2e138c2116c5363aca08b9c60.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "380f1b2c-2633-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689771192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771192, "uuid": "fa1bcbc5-9d27-4c51-b341-bbf8a853361a", "comment": "Malware payload (AgentTesla)", "value": "60b3d1a78968d14549aeecea014a0b41", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771192, "uuid": "79142d00-7fd8-4e29-88ac-7b6af194425e", "comment": "Malware payload (AgentTesla)", "value": "daffe47867bb60e81f6f47acb6ac9161ae2c8ef329648731c86ff877e44c8a21", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771192, "uuid": "94c46211-aae7-46be-a26f-9eb79e04d25b", "comment": "Malware payload (AgentTesla)", "value": "c120e9ec61895f136b177ce04ce5c6a2030df85c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771192, "uuid": "1b0a1932-57c3-457d-853f-a9eaa5dc222d", "comment": "Malware payload (AgentTesla)", "value": "a7318871cbe9d874a3b03746c4868aeb51361009bbac1ce47e455d129ce3918d8fa19220956fe7dfa7695b9f84e99e9f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771192, "uuid": "f437a4b1-1e7c-492e-b61d-a2b8b9bbf460", "value": "T1E245E0101BB58957E23F6775D0F20204AB74EE26B61ADB8F9C6431E55A32301BF11BAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771192, "uuid": "8b5433d5-4fcc-4b7e-99d6-c2ee5c219a7e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771192, "uuid": "29d19bfc-4d84-4e85-9c7d-ec2ff3d1791c", "value": "24576:npQDjoB1KPJKN20PvDN8eNf7cYSd6xokt68rEBJR6kGZ/nk:W/u1EsldQUiGjrEBLBGZ/nk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689771192, "uuid": "93f273bf-4980-449a-89e2-874729e58d0b", "value": 1251832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689771192, "uuid": "ebe4d7c1-e0a7-419a-9939-7833f06990fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771192, "uuid": "91661b24-73ce-4124-b8d9-d5d5c17228e2", "value": "IMG_3760260192pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57ab6272-25fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689747622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747622, "uuid": "1cec2c77-fa1e-4d01-a339-5a1785acb6f5", "comment": "Malware payload", "value": "2736eb81a11e80c7958ec14fe9970157", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747622, "uuid": "a9f408b9-04e1-4510-924b-515020c00298", "comment": "Malware payload", "value": "db4e5406cdd9e4a25d9a7363318b653140701ad62c39654b974644e4110d6444", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747622, "uuid": "88a8f2b7-ffcb-4ec3-ac81-1f9172196361", "comment": "Malware payload", "value": "b99bd5883746fff104ee5ff37a7d4512cef3bd84", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747622, "uuid": "eccfe7bf-c432-4518-a9e3-bbff88bbecfc", "comment": "Malware payload", "value": "c4f764f3371cbf0c014b6ca757e0540194726ee9cc7aabb7795d8d2ca73f4e511124fe57481fb97e35b959cc0465cd98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747622, "uuid": "01852282-5aa3-41e1-9fc5-b5237965d012", "value": "T139863721F283C4E6CC7226F86B557364403C2933CED8783B7794896A3DE5EAB3525972", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747622, "uuid": "ac3260d5-7540-4b8d-8898-a8d723c8a487", "value": "1dbbbcd79b879b270040089431be4013", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747622, "uuid": "32261ff2-6bcc-464a-abed-97bc32b245fd", "value": "12288:2bi4AKzNIvHYBoapFVtzPHXYwgM6BEL8s1RATh73PzXTwnT1cQ47gDckpPWUNQVj:xV6ebapZzfUMq11L8+WdH/GPP7Vknu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689747622, "uuid": "f6d9279e-1669-4566-85fe-be7e6f302124", "value": 8424935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689747622, "uuid": "4aff9160-243a-49f3-a576-520362cd009e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747622, "uuid": "0ba61637-d238-498b-ac1c-12a19ccc5c9c", "value": "2736eb81a11e80c7958ec14fe9970157.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1640f1f5-25fb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689747083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747083, "uuid": "4649ccc3-8122-4d33-a17e-4ca40a27c661", "comment": "Malware payload (Mirai)", "value": "46ee3a88945d3791804f9ab7a8610bbe", "object_relation": "md5", "Tag": [ { "name": "2-59-255-213", "colour": "#A4F8B9", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747083, "uuid": "1eb2f533-e404-4312-a2d3-66879d1a7ccd", "comment": "Malware payload (Mirai)", "value": "dbc1bd9b4cc2ea050900ad28a9e6836403bcdf7a9bf9e51de054b645abd01c73", "object_relation": "sha256", "Tag": [ { "name": "2-59-255-213", "colour": "#A4F8B9", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747083, "uuid": "49f79f42-b935-48b0-aa4f-d5da7184c4c5", "comment": "Malware payload (Mirai)", "value": "8a3e598b5dd4aa678981cc589422338e58b2b7e7", "object_relation": "sha1", "Tag": [ { "name": "2-59-255-213", "colour": "#A4F8B9", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747083, "uuid": "a575103d-b0c6-49b9-9098-719927c3cae1", "comment": "Malware payload (Mirai)", "value": "29e46425df6d501c2a5b84348b0f30ba1a0ae49afcc27e00833cea48175b8deaa4b7b50d0485a417748a427301b5c102", "object_relation": "sha3-384", "Tag": [ { "name": "2-59-255-213", "colour": "#A4F8B9", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747083, "uuid": "df6dfb75-890c-4952-96a8-3f9b551b9e95", "value": "T147D2E021F65BBDD1EC0181B5BF1ACD9FA268EC07876D628ABB548401A85F3BD0F75B40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747083, "uuid": "fa5e992b-bb8d-412e-a431-674e67a3d40e", "value": "768:R3/0JqHnYriRwKZZu3PBUXORGitXSvrnd:5fYriRZE3PBK4GiBerd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689747083, "uuid": "0576b6f7-36ab-4184-aedc-86a7f1618aa3", "value": 28380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689747083, "uuid": "4eab0248-7f22-4273-9f0c-a1118cbc94b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747083, "uuid": "bba89b33-fc5f-462c-9fbd-860635a9704d", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b422b1fb-25f9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689746489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689746489, "uuid": "b3e383df-19a1-4bf4-b7e3-2ce83acd2855", "comment": "Malware payload (AgentTesla)", "value": "97199593b1d4b0fd8a888bc077108325", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689746489, "uuid": "b943346e-73b1-44cf-b3c1-74e47576852a", "comment": "Malware payload (AgentTesla)", "value": "dc77bcebcccf792e8c87aea9ddc452b361e6f4da04bb44daed22b52670a8443b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689746489, "uuid": "a0a9ff47-c77a-4df5-91d8-f8f6ded07606", "comment": "Malware payload (AgentTesla)", "value": "e5fa1a30f19a0f8dd4f2332e25c80f5c90016bdf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689746489, "uuid": "4bb194f6-2f3a-4e08-9a13-59ca76e69729", "comment": "Malware payload (AgentTesla)", "value": "b69693ecf4053f6d976fe8cac065702bdf2df08db6f163bd90ce36dcabdc881697040579eb5b20fc1137126b9000652d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689746489, "uuid": "6a89a94f-2714-4b04-ae6c-41416f9b0c78", "value": "T105F4E000323C9F27E8BD57F9A524A61443F85A57626FC7488EC73CEF3996F504A41A2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689746489, "uuid": "b714a1cd-c807-4279-8dea-7d5e48b996f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689746489, "uuid": "cca15566-66d1-4f37-b180-506861b0c877", "value": "12288:Vf+1fcW9RoA5fb/WT4UkuZb0o4kUUJWOUAfv9wGlFsHKlhu/:VG1fcW9RoA5fzW/ZAp2J/fv9wGfMKl4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689746489, "uuid": "e74bd058-dd8c-43c3-a763-863b46b62f8c", "value": 752128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689746489, "uuid": "1d1f7bda-02f6-4ce3-be3b-2b45042ea628", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689746489, "uuid": "4eef6a08-a344-42f9-bdef-c30334e3b2f6", "value": "LBhouF2GQnuP6aT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "582c325e-2683-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689805605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689805605, "uuid": "565179cc-fa08-47e8-89d7-3a3c94c7fded", "comment": "Malware payload (Amadey)", "value": "dfa56cbad202a2435d79a818272f570f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689805605, "uuid": "9e624a3a-c076-46f1-becb-a6f46c0d48bf", "comment": "Malware payload (Amadey)", "value": "dcba1aa4b4d92b68713b03f12985b0b0689055b3921e0273506d23f7e675ff52", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689805605, "uuid": "76f18a63-cde9-4f56-a03c-1d2827bdae0f", "comment": "Malware payload (Amadey)", "value": "e80debbcdc1082717b4698afca0dd27057a96a05", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689805605, "uuid": "5d79037c-e268-413a-911b-6d2cfdf6aed6", "comment": "Malware payload (Amadey)", "value": "29af6200ea716e7d95faf8da279f7c5d81b04afbbd43655088ff153a205ab7545b9b9570eb532be37d46cc851173979a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689805605, "uuid": "b4fdab4d-6ff4-41d4-92ff-169cbee4bb3e", "value": "T108359A113E6BD519BA11AEAD7CF3796B43BFD3811A822E284599C25085EF0D0B710FB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689805605, "uuid": "20b44d75-3d21-4b9b-8c7d-9219a237f63d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689805605, "uuid": "a112c90f-eb55-4bdc-8794-2f1fa60ca34b", "value": "12288:kdNibkqYkXqNOxjiwMV4hgsGBvHGJKdZM7SahvtzfnD2JE++QhRPdLibkLf/u:qutX2OjiwX29pM5lj1++MPXu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689805605, "uuid": "0db4a1f0-8e71-4905-a234-7307de48d7ca", "value": 1058816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689805605, "uuid": "52f59789-4d87-481f-9a66-a497392d0a84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689805605, "uuid": "13621564-86aa-480e-b5e2-b0de1580c30f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f2fca8f-2618-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689759661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689759661, "uuid": "5ce23404-6557-41cb-af88-d99fca61e578", "comment": "Malware payload (AgentTesla)", "value": "bb288e015fa6393d15500464c0f11b71", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689759661, "uuid": "0803d052-96b3-4e55-904b-55516653798e", "comment": "Malware payload (AgentTesla)", "value": "dd8a3c0c94bb684dacc9f794f75670f0fb0a969f9abcda7b0996cdfcb69f1b32", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689759661, "uuid": "a5791f36-c50d-41ce-99b8-ef66f6c0a595", "comment": "Malware payload (AgentTesla)", "value": "29e1450afd3151667a29fb030370d72378662900", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689759661, "uuid": "4a220624-deaa-4399-901b-f9c3235f8a5d", "comment": "Malware payload (AgentTesla)", "value": "1ae7a1ce792ed6af692ee5f7b5cd4a3125133bf5fcb4c9feaaaa1f8b921d64f42f924ecf30e83f35830ceeb0d652149f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689759661, "uuid": "b05b2322-5a9e-4c15-93db-feb58b698f7f", "value": "T101E2F1A9E68CEDE34569A89E89730B40CDAC1403E19C8A48A0246DDF16E0F4FDCEDD4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689759661, "uuid": "25dce5d6-8a4d-4d99-9f4f-5bc5e5fd89c2", "value": "768:+1w1kzYW6OrYhFtijja3c3patcB1hPGUoqJ:7lWfroOqk881hPGLK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689759661, "uuid": "3d1b9cd0-b1c4-455a-8eb1-2ca39ff8ff2e", "value": 31271, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689759661, "uuid": "76c1d587-dfd3-4c0e-af38-af6d5d8676d1", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689759661, "uuid": "282b678b-6973-49ed-b51d-eb399a10ded4", "value": "SWIFT BANK COPY.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03d47c76-265a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689787854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787854, "uuid": "4951f5fd-6064-4485-b614-d69df5062adc", "comment": "Malware payload (RedLineStealer)", "value": "a16ac9ef7483e3521231c15a522765cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787854, "uuid": "6b300865-20b5-4e97-bf92-38bdacf3c594", "comment": "Malware payload (RedLineStealer)", "value": "de0b656af41759ffa8477cd8c387f71b8e3cbddbc718028139d53bc1c6b95d69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787854, "uuid": "32e1582c-1ce0-4935-b959-b0be056fac03", "comment": "Malware payload (RedLineStealer)", "value": "4d101b7b20025d4bd709a1db554f2f5d4beb4e9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787854, "uuid": "797dde71-642a-4c7d-a386-f28daab5c262", "comment": "Malware payload (RedLineStealer)", "value": "fdc156c784c0074d29245bdf2d9bb97c326ec0bb5b9e021a8c8242ec7ff747bcf987aff098e3c6af45a1ec8d31281128", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787854, "uuid": "68ad86e1-2b71-4f23-86dc-4cfaf779a48c", "value": "T140840112B6D85572ECB4173059FA13831B3ABDA1AD79837B2794644A0DF39C4A83273F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787854, "uuid": "bbf79ee0-bbd5-4584-a15d-5a616282bfc9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787854, "uuid": "606236b3-d1a9-4812-8dc6-4f09e5ddea9e", "value": "12288:9MrRy90FVDc5PBTcopqsqeYaacHnl9XyLEUH:sykS5P5TgaJHGv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689787854, "uuid": "5f8400ba-dff4-4e8c-9785-06a1a75516dd", "value": 399872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689787854, "uuid": "beeb75ce-ec7d-4328-9cc2-7c8792befca7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787854, "uuid": "dca1081f-6296-44de-97d8-a3d5000cfbe8", "value": "a16ac9ef7483e3521231c15a522765cd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a924b95-2641-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689777370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689777370, "uuid": "b98ff691-bf8a-4509-afed-01fd581d2ee4", "comment": "Malware payload (AgentTesla)", "value": "6f7df08a1c9460f2db8c1a9397e47d49", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689777370, "uuid": "34b3082a-0d0a-451a-a21b-e9d0c947bb0c", "comment": "Malware payload (AgentTesla)", "value": "de59559170968acc750e3a862b5125ecb1c0be7fd5bfd58cb1981e65fb147aaa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689777370, "uuid": "887161d7-a0df-4e66-b911-5088d7113412", "comment": "Malware payload (AgentTesla)", "value": "187484c2367260b855c002792965e14ded8dc139", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689777370, "uuid": "b0e48c96-b268-4c86-ae08-4171514f191b", "comment": "Malware payload (AgentTesla)", "value": "037d413d7bcae46a9f38ae7e053f49c51b13855447c5392959f19f02c79792d3418a0fcb4a94931d7bf7c0c6067c4ec5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689777370, "uuid": "b23f025e-05e6-46df-85dd-10661c258a6a", "value": "T1DFD4020036A8C713C27487F90728A74453BAAFEE6466E12D9ED6FCD3B5B2F154940D2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689777370, "uuid": "9643b224-fd10-4614-a0f6-8ec36a07631d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689777370, "uuid": "e63bca4c-ab2c-4331-937a-4f67bf542d92", "value": "12288:NwPYPfY76Z8FShozg+xEQIdUPoMgPIakVmya+fMz:2PYPgyhozFimon0Nkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689777370, "uuid": "f4d7141a-cf32-4cd5-82cb-6233a4a9636a", "value": 654336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689777370, "uuid": "fd93718b-a3e8-4744-a287-c770b72ea04c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689777370, "uuid": "9782d3cd-5b2d-4949-b613-8fcd0db56730", "value": "attached Drawing.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "537d62f0-2659-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689787558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787558, "uuid": "33fe6993-ccbc-486b-bc9f-129d3d4e0455", "comment": "Malware payload (RedLineStealer)", "value": "8c822fcd3a0b7b5ebfccf744af82110d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787558, "uuid": "e266c283-d785-4f69-8524-7f2357950257", "comment": "Malware payload (RedLineStealer)", "value": "df326d92952e92a20353a67a6376a222f9141ccd137eb50890fd58f252e85caf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787558, "uuid": "32838ade-43e3-4c64-83d4-9fc65712afe3", "comment": "Malware payload (RedLineStealer)", "value": "2792bea76a22eed2cdad052b152fb35a36b1af78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787558, "uuid": "5aa78f6e-c159-4684-a211-21f41b74c9c8", "comment": "Malware payload (RedLineStealer)", "value": "fa2e290a00df1cf160a4cc8c99895995328f44f715777e639274d5c2bdcc0cde6e956fec974312475074d1a9961e90d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787558, "uuid": "23836355-9346-4dfb-8117-ec7707e33cff", "value": "T157840103A7E84433E9B5137068F602830B367C96AC79937F2396A85D0CB3685E57677B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787558, "uuid": "2fc863ee-7281-4f9e-8197-3b59a6b7d142", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787558, "uuid": "62c07de0-784a-4f3a-ac95-7f13312f4ff4", "value": "6144:KTy+bnr+Mp0yN90QEcj63UmykW6nZNFPR5DWZydfEYd6x0CcHnlRHeXxQASn2cRV:1Mr0y90fcZyddk7cHnl9yXS2cb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689787558, "uuid": "96cde158-709e-475d-8b48-0b97cf396601", "value": 399872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689787558, "uuid": "120d7fc3-8d27-43a6-be48-5527d737f1f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787558, "uuid": "fbd0cc09-46bf-4138-81c4-ef86d75962ed", "value": "8c822fcd3a0b7b5ebfccf744af82110d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdac159b-2610-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1689756383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689756383, "uuid": "eb05e9d1-0d6b-42f8-ae8a-71dcb13848de", "comment": "Malware payload (Loki)", "value": "a057b9f3492aa62c7eff4e42f842c6a1", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689756383, "uuid": "865b3f9c-98db-4f3c-a65c-137a61cb5524", "comment": "Malware payload (Loki)", "value": "df4da7cc12f75cd440fb0fe9c96ea12263b8441f020d7b4e0fc487e6aca3c58d", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689756383, "uuid": "86a82f19-dbcb-4782-9c58-649094f69cba", "comment": "Malware payload (Loki)", "value": "5a94ecb98f3ff3a54aeb524e63cd028be0fcf032", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689756383, "uuid": "136b397e-0310-4e34-9034-c91e67e575c7", "comment": "Malware payload (Loki)", "value": "a440e893763733b13b8a5f3ae239e93d41e170a4da70aff6b3ad276ba0f630a5f2a9c111e38d268e656e546ec05211fb", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689756383, "uuid": "e1977ca1-869b-47d5-8de3-76ed712871b5", "value": "T10FB4233153D1FB6FF493A77E8422EA34115BC3114AB1A86EF02FE13991DFEA21861C95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689756383, "uuid": "b6a5bd3f-29bd-4075-9783-f05ef7a14da2", "value": "12288:O0BMfSN4ZpAmgjj9y0lDlefxd5VEwthPJrE+ItgofFVm:OIypGJlDQZd7EwthP1ItHfnm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689756383, "uuid": "ef92a523-6212-4000-ade3-5f015bb791fd", "value": 512436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689756383, "uuid": "5ae507bb-b860-4849-8b05-6d42412c6f3a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689756383, "uuid": "d5b434b0-f25b-454d-b1cc-1d75382483a9", "value": "PO_1193353.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fbacc54-2633-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689771339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771339, "uuid": "3307a606-5532-429a-9df0-d0a16748eb43", "comment": "Malware payload (Amadey)", "value": "98b669a43ac6bc97726b69bd7c194f8e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771339, "uuid": "b5ccb0b1-e01d-45ac-a65a-a7d54a404c5d", "comment": "Malware payload (Amadey)", "value": "df61749cf26e18f6b4a0d5a560a0b57c3509daf65b851aba67fbe599a166bcd2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771339, "uuid": "be83de6e-8994-4b18-ae4f-2184f40c094b", "comment": "Malware payload (Amadey)", "value": "1a056db6d10213333d6c2049b977ea44a708fd97", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771339, "uuid": "2d756016-683b-4de6-b48e-12151e1cb6a8", "comment": "Malware payload (Amadey)", "value": "df8939243e405e4bea45730b151d7b43359b757aa9a738cc848d82e9684e3cc0240575f8e67ec2db254829b628ef1d54", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771339, "uuid": "f0f701a2-0328-4f60-abe7-773b37340875", "value": "T153840253E7E89073D9F4277009F616C31B34BCE19C38C37B2696A95A0DB25D8A27172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771339, "uuid": "582aa322-e93b-40ea-ac04-29f2c3e17bdb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771339, "uuid": "e79a8fe6-2ba0-4c97-90f5-7cf694cf7899", "value": "6144:KTy+bnr+/p0yN90QE6sSIPDncYiJpif2BZ/pEYvnjbPf/gDVc/CcHnlRHkhXAwDT:BMrvy90bSyr3iufstv/Pn1KcHnl9xBy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689771339, "uuid": "e4063ad6-c839-4b06-bd47-b7af6a8bf666", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689771339, "uuid": "dac739bc-c958-4930-b9dc-5d83c036c17c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771339, "uuid": "74a7178a-73dc-45c4-91cc-22742d465a99", "value": "df61749cf26e18f6b4a0d5a560a0b57c3509daf65b851.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd2a1832-2648-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689780461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689780461, "uuid": "968c5d3e-4125-413b-8542-4bdb7d89434b", "comment": "Malware payload", "value": "4a7238010d29353e4c09c626094338d2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689780461, "uuid": "524a80fc-1f71-424e-b3f3-9cf73b152ecb", "comment": "Malware payload", "value": "df939af1bb478c4d80ddf03883df40ddad267b4ae9c2c739b6fcccff5e65cfd3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689780461, "uuid": "cbdaf437-93c7-44e2-9705-08753d455d94", "comment": "Malware payload", "value": "294ec4b3dcc7281fb64c22a41ccf1126a333ae33", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689780461, "uuid": "800e31a5-7469-423e-b689-a4c4569f43cd", "comment": "Malware payload", "value": "20a1ca53287689203674ac0b2da243a104d55f4b58fb80495a82b7f24c400dba729cd17f5ec2cec442571fdf15fdc27b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689780461, "uuid": "6db9b385-d002-46a7-94e7-40c084898db0", "value": "T1D9337D057290C0B3D5AB163969B9D721077FBC629AF480833FEA164D5EB11E07A3D3A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689780461, "uuid": "5943fa33-7b4c-4db9-8c2b-8ada15c8be1e", "value": "b3c5e81c2a49c8b00d13a96c67599538", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689780461, "uuid": "c85a0965-1688-4297-8b84-e1d3faf67e1a", "value": "768:CeuMaA0kFY1t5q/7O5+bY8pEdRWFNKgjistyxdjoTtBp3ZCKIgbg:CeuXb9eqRJD7oTtBp3QKLbg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689780461, "uuid": "e6371d4a-5c00-41c8-af80-bcaf402f3fb6", "value": 52224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689780461, "uuid": "6005e76e-20ba-4db8-8965-b96301594e46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689780461, "uuid": "8575dedd-32e5-41b7-99cf-db14e82559ae", "value": "SecuriteInfo.com.Win32.PWSX-gen.25502.1333", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4d54552-2637-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1689773199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689773199, "uuid": "c7faa316-bdf9-45a2-80bd-48558bfbcb32", "comment": "Malware payload (DarkCloud)", "value": "8c3cb6cbee384a1cbff8d1b9a21db88f", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689773199, "uuid": "bf9712ba-11f0-45ae-9d7e-3c295bf7eeed", "comment": "Malware payload (DarkCloud)", "value": "df9601c2abefafaf4da2b6b95d6beb6a8f59d62e527cb803879f49e12bc6a798", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689773199, "uuid": "267b948c-bb07-43be-b03b-4788b9a969f9", "comment": "Malware payload (DarkCloud)", "value": "e8fd0931672e37c9322f8f6b5c63cf04f64aab55", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689773199, "uuid": "fe47b64b-9d37-491e-9482-b9394f8b73a2", "comment": "Malware payload (DarkCloud)", "value": "7068acffbaf7802ae9742da20ea9363c46cdb4275232f028eae97d32f20d76404d264017e6a0e570f5ee71742bd2f56a", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689773199, "uuid": "08ea6bdc-73c6-4133-9757-9ba0eb6ce247", "value": "T1921501DA735821DFC4578C71AA796D22A7626CBE171BC20290273EE8BD3D593CF050A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689773199, "uuid": "34b8124f-f41a-4706-85ad-51b5ea3d520e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689773199, "uuid": "556a89b0-cd77-4b68-9517-d39bfa431728", "value": "24576:dCfzW/ZbGA4dx8ZJ7R1nSoQ8sY3hq/vcchDj2NkWIl:oa/1GA4dmZJ11nSONA/vwOWI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689773199, "uuid": "2a1e5030-90d7-475f-9427-a883021d7d31", "value": 947712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689773199, "uuid": "064930e7-fd65-446f-88cd-66201bd56fc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689773199, "uuid": "a3d1406c-f9bc-46c5-b704-1b3e9babb074", "value": "Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3f7dc6d-2615-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689758488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689758488, "uuid": "8a1e1b9b-6eed-467d-9d76-a2ce39c2b8b8", "comment": "Malware payload (AgentTesla)", "value": "fb99e90fe0f134c7197224dfeb8237a5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689758488, "uuid": "2a75f9da-0e77-4faa-b28e-318c8b08b947", "comment": "Malware payload (AgentTesla)", "value": "dfb26972417447a5fa9c38e213831f8e954c1ca4f72092af6824e8569fd8a68c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689758488, "uuid": "67a606c3-cf2f-4be4-9903-a8a4f8cc4b9c", "comment": "Malware payload (AgentTesla)", "value": "3982112b2c8df0efb2fe094e268cb65dde5ce66b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689758488, "uuid": "5728f9a2-5142-4e2f-abc6-372f2af08eae", "comment": "Malware payload (AgentTesla)", "value": "b307ed9faf6c61348adbec5bbd25fec138d95d636a0d5dc34e5b346ee36de6dfcedb93b7185d50a785e366852c2b7eb8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689758488, "uuid": "bc5cdece-2fdb-4ac6-8c04-19862ccf8c94", "value": "T13BC423EA34CBF2D4759C684B5028DEFD4A069F0FA49177C613B09C82C69C1EC7AE5878", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689758488, "uuid": "33046374-afe3-452e-9229-288bce678be4", "value": "12288:6vywbjNz9i4/30l6uiaUaqAdhxBNWTwSuP1rw2xgHYttU5:md24P6qEbUL2xVU5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689758488, "uuid": "ec581ccd-4e0f-46b1-8c42-523e1d2847c4", "value": 594911, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689758488, "uuid": "d090d7d6-6ff6-4bca-abe4-9a7dc811b786", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689758488, "uuid": "d9dc0f86-4b51-4ee2-995c-8a3f5615eae0", "value": "Payment Ref[GLV12567196618420067.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc0a1721-266a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689795062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689795062, "uuid": "503cfde2-ab17-4525-9ad3-8761242476e0", "comment": "Malware payload (Amadey)", "value": "ce58b970c49b578a1c5c2e58c26dc1b3", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689795062, "uuid": "ec933115-9dc7-4d98-8a11-d9c4c6bef470", "comment": "Malware payload (Amadey)", "value": "e02a12bf4c2ab8618f03d883e4d174b0287a0b41ee0d9bde294e91617e5e11c6", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689795062, "uuid": "101bf367-4aed-4433-9108-3b85bf8db9fa", "comment": "Malware payload (Amadey)", "value": "39970bedd5a7e169e8bd02721c007391062d47be", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689795062, "uuid": "681bc918-7e12-4eee-94da-12c8f4c24421", "comment": "Malware payload (Amadey)", "value": "2181e82c371e73a53ed0fb9eee62cce56fe0c757d6b55aea3a2f2c8fff974e1b9c11be67b3ffcc6cf9a8423863f0f399", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689795062, "uuid": "a383215a-912b-4bac-a2ad-0ba9e363188e", "value": "T1A6840153F7E84032D9F527B06CF612C31B36BDA15D68832B2752A92E0CB3690A57177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689795062, "uuid": "063dea85-e343-495b-ab13-0e3f19251cef", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689795062, "uuid": "ad5aa3b3-e69c-4e0b-a6af-b446c3d743b5", "value": "6144:Kwy+bnr+lp0yN90QEvf43dNyV9R8/SAKIqlDBsUA9/II9ewXBTvls:QMr5y90xQIuulvA9XXBTts", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689795062, "uuid": "dcfe1119-b8e4-41f2-a294-a34caa67e03f", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689795062, "uuid": "a6025762-e9f1-44e5-b590-e168b67bec6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689795062, "uuid": "1003d0e5-b189-4395-9e0f-37814a0ba93d", "value": "e02a12bf4c2ab8618f03d883e4d174b0287a0b41ee0d9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17fe5beb-25e0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Glupteba)", "timestamp": 1689735490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689735490, "uuid": "9dbc9fb8-8ac4-4aa5-b79a-f414b47af619", "comment": "Malware payload (Glupteba)", "value": "724980a41f765dd2a6ac137acd8d5ebb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689735490, "uuid": "f68a4a69-8b5e-40bf-9a6d-fd00d63f2793", "comment": "Malware payload (Glupteba)", "value": "e14d81a826261dc5381baf8e9f90a3f6293f758053839300f5f999883651daed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689735490, "uuid": "79249bcd-4243-4c99-be31-70b5cf893e0a", "comment": "Malware payload (Glupteba)", "value": "c3ac202015b12f882e41fe3085afd54b3404cf1c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689735490, "uuid": "9669f273-6b5f-4696-a260-9ce2f36ca056", "comment": "Malware payload (Glupteba)", "value": "8bc7526d47ab09a8c3299db4a7a810f6549c16f4d15d76072851b0528501bed2b2ab71d39fabee695c9e9f50aeadfdad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689735490, "uuid": "5b198e13-520c-4b4b-8603-ffaf171df212", "value": "T16E16225392E17D44EA228B72CE1FC7FC721DF6504E9A3B656219AE6F14B21B2D1B3700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689735490, "uuid": "9b397309-73a3-4b5e-b8c4-95f1c9249387", "value": "652881cb9702ba955ef807f9df82b24b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689735490, "uuid": "cfd27ec8-cfe2-4395-8011-9fa746aba5fe", "value": "98304:rl1biry4pKxJw74pmsb0eKjq9xslCxvihWXN0BZ8nl:rOe48gPMw4slCx/d0j8l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689735490, "uuid": "a1abe636-4d14-440b-ae33-721bd789e29a", "value": 4408160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689735490, "uuid": "c893a6ac-b3ee-44ab-a13b-dbf9f40b86d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689735490, "uuid": "abb95d50-be51-43e3-bb22-084a3219367e", "value": "KvxrchLpkMars3U_9Td_ZPFr.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65607f93-2610-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689756235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689756235, "uuid": "b4684813-ac46-4b27-8946-4232572cf99e", "comment": "Malware payload (AgentTesla)", "value": "b1897de899f87437bf884bff539716b0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689756235, "uuid": "4946941e-5f05-47e6-8ded-b5f3b1defc2b", "comment": "Malware payload (AgentTesla)", "value": "e1b82a8eb5ea3bb868a923672c161662e56ba55501e16e745bf29352ebe996de", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689756235, "uuid": "1d8e6bc1-c8ce-4d36-9b28-70dd19e0d60c", "comment": "Malware payload (AgentTesla)", "value": "921e034478fe2427d6b4175b9639819e5eec2987", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689756235, "uuid": "79ca884d-d706-4e27-b97f-05a83cbbe4dd", "comment": "Malware payload (AgentTesla)", "value": "b8683410208a13a68a0c4f8f5c2947875ef9d7785188284dec3602843b86c37eea6e5c9e710d1e73978071c26011f349", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689756235, "uuid": "a288141b-5990-49ee-ac7a-6c32f72fd05c", "value": "T1D5541220F2E4C17BC4E34A3189302D6A4BF5D324E17A5B672364BFD4B972291E71AF91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689756235, "uuid": "60ea13a4-350a-4c2d-bfe9-eb6f900647db", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689756235, "uuid": "55875add-1ae4-491a-8e7a-ec868609df6e", "value": "6144:ZYa6p5EkQ3+/pTxnJ0KMyKioZUTDRzFJ9X/pBz1prQg1BEz+344jUxBHRmP5B:ZYHi+/pTxCKMyhoZsRzFJ9p11avungzs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689756235, "uuid": "13e9457d-0bf0-411d-91f5-d48307d7cca1", "value": 297179, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689756235, "uuid": "4e28f6f2-975f-4396-823a-92092e481dc1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689756235, "uuid": "11c574b6-b182-4002-a394-13e9e248a4d7", "value": "Quotation 911799 - EM092722.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a8cacdc-25f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CustomerLoader)", "timestamp": 1689745533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689745533, "uuid": "0ac0fca8-8e92-4eff-90a8-b3ccde661242", "comment": "Malware payload (CustomerLoader)", "value": "5a1f5bfe813c32d30d05ceddd4f59879", "object_relation": "md5", "Tag": [ { "name": "CustomerLoader", "colour": "#57A5C4", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689745533, "uuid": "cb26cb4e-86d6-40f1-8e92-bc1846553e23", "comment": "Malware payload (CustomerLoader)", "value": "e1bc760f54db0898b2d54cbe0b3e4a4889480f6ad895d9dbbbd0a95a892f2eaa", "object_relation": "sha256", "Tag": [ { "name": "CustomerLoader", "colour": "#57A5C4", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689745533, "uuid": "805398b3-d306-4740-bf41-1fbbc927fbf1", "comment": "Malware payload (CustomerLoader)", "value": "fc82a67964b170946569604553f5831183f7dd57", "object_relation": "sha1", "Tag": [ { "name": "CustomerLoader", "colour": "#57A5C4", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689745533, "uuid": "a3770240-c5d8-4a91-b4a2-be43217c3a0e", "comment": "Malware payload (CustomerLoader)", "value": "be411e323430dc99491a5d39f31abb202adfd5a370921af07634f7783dfe8e967ea162d5b2be98721f25c90fdd1845ee", "object_relation": "sha3-384", "Tag": [ { "name": "CustomerLoader", "colour": "#57A5C4", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689745533, "uuid": "b5076fec-86d0-473c-b7c5-4c35a722d2db", "value": "T16C45C00356AC002AD25A1778889B0F0AEBF49AE277278A575BFB530D1DB73143A3D394", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689745533, "uuid": "e1eac21c-7d9e-4e81-a99c-7518214cec57", "value": "768:AlntUMmjH+43M2F7Tllmu24Ra2DovIieNhIPVQPabLBAtPj:l+92JTll92m7ov0oW4LBk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689745533, "uuid": "d7e7289b-6153-4983-8a5c-60a2b1ba61fd", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689745533, "uuid": "e2ced86d-693c-473a-a50d-d724f244cfa8", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689745533, "uuid": "e5297df7-bec9-4a9a-b46f-8af062234684", "value": "Order_ JUL07 01BB77FIBA00541.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b4d49be-2647-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689779921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689779921, "uuid": "1027704a-5585-414f-a313-cb46ed53e9e7", "comment": "Malware payload", "value": "2134ce57c884ab2e6dceeee3cb30673e", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689779921, "uuid": "64cc1e7e-a05d-4b1b-a658-65b50eb7fdd0", "comment": "Malware payload", "value": "e288c853afd9e6369767d14553ebd6a471d2adb2a2e5b6b80f487d8e3d84d7d2", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689779921, "uuid": "61fbe930-cc2c-402c-bbf9-9ca4736b5297", "comment": "Malware payload", "value": "a06dd52b802a6dd4bdee4b57f0de6da70bc3c128", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689779921, "uuid": "1c6b43c1-ce1f-427b-8925-1d26a6d43fc1", "comment": "Malware payload", "value": "77b203320b9b5b86bf6a14fb4a34c680c2e50308bc9ffa7db061c82dcb4af96c806fefc1a5b4867625534932683fbb3c", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689779921, "uuid": "80b48e7a-89d6-4d4c-8321-aca9b07651e4", "value": "T1110523B13DF66385837D0B34DD01BA6827B17D22D91E3B532D63CC099772E58A8DAC68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689779921, "uuid": "069a67da-624e-4453-8ca9-ef82f9d463bc", "value": "24576:jmvuZQmZy9mzEYJGuwfLiry3JrUwxx5LFVQHDGs:jmgxZyMEYJrwfQy3JICF+jT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689779921, "uuid": "c567563b-a57e-4e3d-8328-20fbba4c6496", "value": 797380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689779921, "uuid": "579aea96-b7ce-4f94-88e9-8ae2180e4534", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689779921, "uuid": "d97851ca-f783-40f7-99aa-afc20cbc1526", "value": "Pago Detalles_53709370.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "836b1938-2648-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689780337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689780337, "uuid": "be15ae09-1b12-4873-b698-ed575c141ab2", "comment": "Malware payload (Amadey)", "value": "5a011cf936b7076f405d8f538d99b5ce", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689780337, "uuid": "4d907c49-a330-49fd-b0d2-d59d321980fe", "comment": "Malware payload (Amadey)", "value": "e2994359a2832004801711039ae03edc3b4433f906e6664fa73f13ca33b95a78", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689780337, "uuid": "ff801595-45bb-40d0-8caf-4389ff23ceaf", "comment": "Malware payload (Amadey)", "value": "b27b524e4b0196a488ce2989342c5d1a787d0b41", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689780337, "uuid": "f74ade33-0f3e-4acb-85f9-b27eaa2b0c8d", "comment": "Malware payload (Amadey)", "value": "b2fbd7f6ff8301bc5f3e27762476cd755aa4c467f74736ae243d61017d4c1550ef7e3c9aa55d32a1d38cc14547efab0e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689780337, "uuid": "f35f2379-a17e-4516-bdf3-6555b6804bae", "value": "T150E2F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689780337, "uuid": "9d649a49-2fe8-4a42-ae56-b2d640b9af47", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689780337, "uuid": "9fb505c4-3e1a-4e90-ae04-6acb59481015", "value": 31453, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689780337, "uuid": "092287fc-3781-41f7-a2d8-de0ebc83387e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689780337, "uuid": "7e94a203-ca3c-434d-a94a-3901ca79b147", "value": "5a011cf936b7076f405d8f538d99b5ce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "128f4625-267b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1689802052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689802052, "uuid": "bee222b2-033b-4186-a54b-28cc6b340d68", "comment": "Malware payload (RaccoonStealer)", "value": "00849efbfc868301729148fa957e35b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689802052, "uuid": "1b9b1d81-adbd-4171-8819-585fbe5b890a", "comment": "Malware payload (RaccoonStealer)", "value": "e2cd080304d92494e731ad88d60f1ba38670ba4a751cd8df1e09d6702345999b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689802052, "uuid": "9da80459-e86d-4bf6-af4c-771af232867c", "comment": "Malware payload (RaccoonStealer)", "value": "fdf3feedc18b8806f3bb15e785907d2a738859bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689802052, "uuid": "99bad273-6e0b-4294-aa86-6f9a716d7b61", "comment": "Malware payload (RaccoonStealer)", "value": "f175b613312b14b2dbdc0ca8482a5708235a432868e86df1e37ce127499e611b970498bc97320d782b6c74c6e9f9df11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689802052, "uuid": "847aa556-63ee-4542-9ab9-2a0ae13f046d", "value": "T13C06234105EA16F9EFA03E7D5760A6B72D9E396865F0800637D134E89EF8CF2C790279", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689802052, "uuid": "e747ca0e-d54c-4371-964c-50c95efa7d88", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689802052, "uuid": "df99dd9f-f70e-4223-92be-eff8465eb752", "value": "98304:Owp1OWggbmRn32RdGZXutOldZz/aSXtxpso:OwpUW/hu+eZz/aSXtrZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689802052, "uuid": "52316ac5-096f-424d-9085-a2b3bd844970", "value": 3698688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689802052, "uuid": "0f10f6c6-4120-4884-968f-effc19904681", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689802052, "uuid": "b1376771-a57e-4441-8741-e04d9250acd4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64d1ec25-25ec-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689740772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689740772, "uuid": "d56add44-83f3-44ac-b664-7325489b12a7", "comment": "Malware payload (RedLineStealer)", "value": "3d036050d435a5f19a0d57f39e778477", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689740772, "uuid": "059ee65c-b3d7-424f-b7b9-28c07af41859", "comment": "Malware payload (RedLineStealer)", "value": "e30fb0167cff4b0cc4cbc651e4c833459e94a603b8b9a33d449986ca641f7ce8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689740772, "uuid": "94cf284c-2836-4f5d-a709-10428bedbe70", "comment": "Malware payload (RedLineStealer)", "value": "5aedae0a53d89bb5d66677dc1790382032fbe602", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689740772, "uuid": "3fb8147a-01e8-4484-8f01-e2204d1ad191", "comment": "Malware payload (RedLineStealer)", "value": "1f281441d1039b160cf6803936eb203541670b0a9616043137bb0347914266125c152e24d27b2763a6dc3c17617a8083", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689740772, "uuid": "ba228157-8e5e-4cda-bcb6-25dd16f9c570", "value": "T163F5F8D1BA40FC00EB66A933A6860954EB527DE6BF17EEF62C47BF1627352918C00357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689740772, "uuid": "5363f2b2-2ef0-40fc-a6ad-e38b0f729573", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689740772, "uuid": "553280fe-9a08-40f2-8635-b50c5b7e081f", "value": "49152:hNm/ZfPL/t1VX05/rOfGAvk9Qwm4Je4DWRclihVWe3ruSUkRH:hNm/ZfE3m4Je4CyneSSDRH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689740772, "uuid": "d7bd1263-bd6d-4a03-a2c5-67689f76a8ff", "value": 3328048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689740772, "uuid": "fc1baef9-af80-4916-8b5e-dc9f905422d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689740772, "uuid": "1c14bba7-7476-4c46-b30c-2e712d75dace", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c77557d0-25f8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1689746092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689746092, "uuid": "733a5092-0555-4781-b084-8df2db062295", "comment": "Malware payload (GuLoader)", "value": "4f2a7f1911f75d720f5904759d9d48da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689746092, "uuid": "42875457-663c-4d29-9da7-1ffc1aa9fdec", "comment": "Malware payload (GuLoader)", "value": "e4017fb78b5632f3c604f2585f1119811dd1043cb3d31274df0953ecb0b616ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689746092, "uuid": "85dd875a-0908-4dc2-a6b8-52e6cfb13e41", "comment": "Malware payload (GuLoader)", "value": "8a6a79b7868239d74d5bd1cf6380324bc89479f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689746092, "uuid": "6a70f1a2-ee88-485f-bdaa-736f7cec449f", "comment": "Malware payload (GuLoader)", "value": "2bf280f1e2f070abe6c1a664a28d58f0ae0f3ffd681c156fd5bb66f82f924d40d0e6b91fa33153a06d101a5bdbb48484", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689746092, "uuid": "7a1a79f4-9593-4020-918b-17e25e5bd090", "value": "T14B84BF91F2DCACD5DC1213799C77ED262527FE399471091E222E76296B33293306BE0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689746092, "uuid": "7419f536-8520-44f4-b699-496ffc337afd", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689746092, "uuid": "8b266edb-d31d-44c0-8bbd-45fef9cbd42b", "value": "12288:NgeitNJWyy//6AJq51mrX9Z4UL3nwyUYnEVXv:l8NQRUQD9ZZXwdh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689746092, "uuid": "3c24f1c6-48ea-4fda-ac67-6129f66a9ffd", "value": 395154, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689746092, "uuid": "5df10866-2e93-4d18-bf86-bad19a52d914", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689746092, "uuid": "e960eaf9-3750-439d-a10b-74a1ac339920", "value": "PURCHASE ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e34b332-25fd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689748090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748090, "uuid": "6436879c-1996-4c4f-a233-b21831532dda", "comment": "Malware payload (AgentTesla)", "value": "bad1823f9b6ff9ea41bd0bf58c725a3a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748090, "uuid": "0eb47109-a8b2-4172-9c19-00f4601f162e", "comment": "Malware payload (AgentTesla)", "value": "e42328227b486a20674f9f12575df0a2bc3cab93a0030aa91c217c97ef56063c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748090, "uuid": "9be1a23c-b23d-4bb5-9bd5-9074d0e4afe6", "comment": "Malware payload (AgentTesla)", "value": "39595a37b178e4ec10fa1666e156e2a5eb771097", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748090, "uuid": "6fb67822-363e-4717-8baa-eabc315ae24d", "comment": "Malware payload (AgentTesla)", "value": "6c75d08bad62b724009caf97f898b7754f3b49345a0f9069f2c3b7a229eabe112b0b2c733d22a10537c1b87a432cdee2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748090, "uuid": "7ea3a713-7062-423a-ba81-4cf62774accb", "value": "T140A49D012EEF41487673AAAB57F155E54F7BB975253AD49C604E070A0BEBEC0B900FB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748090, "uuid": "91c6dfce-7805-4ef2-95a0-62b729123061", "value": "3072:35XNsn1+7HLDVZwMxzakyTlvspNUzSty8txl50h/pfz7TgYbdHznXmxLJIrCsS4V:4n+cMxzakU2ty8txl50h/pfz7Tp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689748090, "uuid": "3048a76b-8fdc-4297-8037-ce2164967787", "value": 492628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689748090, "uuid": "1cd416c5-ca18-4ffe-a55c-83aabba432c2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748090, "uuid": "07b0cce5-1364-4647-8135-68c4920d0582", "value": "DHL-853934665.pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4ca44b1-2685-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689806700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689806700, "uuid": "d6314202-47f2-4c2d-9e65-f19c8442a046", "comment": "Malware payload", "value": "d92527242c51f241b02b335602848648", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689806700, "uuid": "9e56b742-120b-41d8-bd25-756c487797ab", "comment": "Malware payload", "value": "e43b14ca0507bc7186e4096d7a9fb6d1ade449b4de67f03f9a33fabb172f7781", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689806700, "uuid": "9499762d-7115-4e6b-9ea7-b0d03441f3b1", "comment": "Malware payload", "value": "07045d32b9b961c4d429aafdbff5996f80dde1b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689806700, "uuid": "e48d8edd-b190-4bea-82eb-35273ae885ef", "comment": "Malware payload", "value": "7531e0b7bdc738e725d586f361fbca3479d61043f849a8b6eb5c73559a7b9a222b460c21d22ad151e41610a042bcb3f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689806700, "uuid": "9b9b47f8-c656-488e-a176-4bae1d79665f", "value": "T1D6B41203A7D94033C9B6677148F713930B36BCA65D78932F27856A6E18B36D4A87037B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689806700, "uuid": "17858b36-bcf9-496b-b8d2-4e884e9bb6c0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689806700, "uuid": "6d1eac7b-a397-48fa-a228-757aca9941de", "value": "6144:K2y+bnr+gp0yN90QEHtrVFXr0lKbZqd0k9zTRwsg5bQxeMYqe/yZIl17oNz1K/fi:GMrgy90vX4PT2rQjg/bwzEf3wknVDu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689806700, "uuid": "4e8b9df7-08ed-481d-9cb5-e6b722ead8ae", "value": 527360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689806700, "uuid": "1250de7d-4e2f-4631-bb12-878b718f8549", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689806700, "uuid": "5809f663-2057-45ba-b720-8b062bb933cc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b97cb8a-2627-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Hydra)", "timestamp": 1689766124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689766124, "uuid": "a1b99c1c-f6fe-4fe4-b973-d39301a46e14", "comment": "Malware payload (Hydra)", "value": "4049e8f9c4dfb9d95bdadcd531c761f0", "object_relation": "md5", "Tag": [ { "name": "android_hydra", "colour": "#626579", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689766124, "uuid": "f53618d9-6d8e-4e3e-8ce5-ab5aefe49b72", "comment": "Malware payload (Hydra)", "value": "e46fda11783cad7d03f9b8774f58f82aed112229599029d860ee34408468cae0", "object_relation": "sha256", "Tag": [ { "name": "android_hydra", "colour": "#626579", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689766124, "uuid": "a3ccb8c2-6da7-4021-9538-2bbbcb7c05cb", "comment": "Malware payload (Hydra)", "value": "16b46497f8ac4644c3f4c69c2888ad2badb817aa", "object_relation": "sha1", "Tag": [ { "name": "android_hydra", "colour": "#626579", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689766124, "uuid": "ea8511f2-c37a-459c-abc2-a24ea1395dce", "comment": "Malware payload (Hydra)", "value": "525ba8ad08dd3cf924e5e0cf3f3180678e5bbd87479b6a31e743c11a4e8cc4acdd63f829e84544094e7122aabda756f0", "object_relation": "sha3-384", "Tag": [ { "name": "android_hydra", "colour": "#626579", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689766124, "uuid": "d1a96f02-3984-4ccd-80ba-440e2afa51b9", "value": "T1A5163390F0E87A13DAFE43786D74A1C1032BBE56CE55A56B38227B1D09739D06D608FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689766124, "uuid": "7978cf43-1a24-45e1-b4be-f1f047f26a96", "value": "98304:hs70rG/gEUf8R0S5JQbEj2WoAKcbAp8C2TSnjfyra2YyH0ThV58:jrG7UwpKwXAg+njfyr3YyHGC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689766124, "uuid": "6ecb6cfa-aa8b-446e-9139-26ba6e4d14bf", "value": 4044526, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689766124, "uuid": "5522cbef-0fc3-4836-8a2d-472b0b059f5e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689766124, "uuid": "7ed8b120-da0f-4bc5-8a91-6f64aa61a15e", "value": "5-aligned-signed_en.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e11ede05-25df-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689735397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689735397, "uuid": "11e7dde0-77d8-47e0-98b2-510588bd4bb8", "comment": "Malware payload (Amadey)", "value": "d5bb92f45f75b97d2c6ff9d6b6c2b819", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689735397, "uuid": "db5565b3-472b-4192-a0a3-6dca351b3056", "comment": "Malware payload (Amadey)", "value": "e493f068c3a8cafad44716e54ab6ab34a7ca9d69c1612b82451a6ed93d6c3504", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689735397, "uuid": "ff6f76f1-6cca-4014-b5ca-63ec1814bc47", "comment": "Malware payload (Amadey)", "value": "0f45ed578ee964f2ae444b743969e1b493a247a1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689735397, "uuid": "590534d3-0e7c-4f39-a62b-76d345f3b562", "comment": "Malware payload (Amadey)", "value": "7fb732b648129a58295d43371ad3932f1c08467d1f97b209e8653867ab46d9f453d76b55d659b33f3176afa27880cca3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689735397, "uuid": "745f4770-6ab5-44f2-8f5b-35a503d495d1", "value": "T1B0840202B7D94033E9B5177458FB03830A36BCE19D79472F2B56A94E0DB26D0A5B237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689735397, "uuid": "7581c1e4-ebe4-4f75-880f-eba58c30b877", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689735397, "uuid": "d75984aa-6434-4846-9277-61fc2c1a94ef", "value": "6144:Kty+bnr+mp0yN90QEM2oyLuoPTPRnzPg/w8ZJw5kD9VBIU+e4HL8rTRKzslqg/:PMrCy90LLHFY/w83w5G1a8/Rmi/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689735397, "uuid": "ae37b5b1-2dd3-4545-ab0a-124e1aaa8c03", "value": 399872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689735397, "uuid": "246debe2-eaf6-41c9-b81a-9e4f377ab03e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689735397, "uuid": "ad4c774a-6a36-4818-8312-e4459990f135", "value": "D4DB.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02acad00-265a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689787852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787852, "uuid": "23dcd5ed-d495-4d6e-81a8-fa2507ee36b9", "comment": "Malware payload (Amadey)", "value": "e25c0f739b20c011d009b851bde14d08", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787852, "uuid": "342ccbe5-3e41-43e0-bce4-03e2cd8fc942", "comment": "Malware payload (Amadey)", "value": "e4db4dc011fcf08e0903987fda79e0fb7e4702724b3738a2c487b9921d6cd1cf", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787852, "uuid": "c7233042-4552-46f7-ac77-4465906b1fdc", "comment": "Malware payload (Amadey)", "value": "f23c319bd12845ea2d522198c22e950cea9ac1c1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787852, "uuid": "44f5ce64-5ed8-43a9-bee3-1e08afb92727", "comment": "Malware payload (Amadey)", "value": "a5bf210d88eeed12257c6a1f04d3d2a2b51673172bae70f4e74c5adb57957666ee788425a73bacbea6c2d56108c2f2c2", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787852, "uuid": "7be98e0a-46e3-4e92-aded-342d1a7b1570", "value": "T175B40203FBE89023D8B517B02CF6428319367C656978935B33C9A85E5C729D0BA7277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787852, "uuid": "60cc5ec4-df40-4abf-ada2-250d1c893667", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787852, "uuid": "0768a1ea-9516-4915-9c83-818eec50f13f", "value": "12288:wMrFy90F90Cm4Jy2YozYBzyHRPZ98rpYgTj5waMV7W:ly290B4A2jYlyxPwHZ87W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689787852, "uuid": "7695a7ac-413e-4d9e-8bc9-6787459fd090", "value": 527360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689787852, "uuid": "0e60c1b9-6de3-4ac8-a1b7-d4a7ae7ab274", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787852, "uuid": "23c84ab1-f7ed-4ec7-affb-66516f089fac", "value": "e25c0f739b20c011d009b851bde14d08.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdc9a834-2648-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689780462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689780462, "uuid": "b08b3044-dbd5-4fc8-af8d-04e5f52fffde", "comment": "Malware payload", "value": "ad0de2a1ceb0c255fc83f4ee2a2535ae", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689780462, "uuid": "5472bda1-c2f4-4493-b3e6-6fa6fec1b199", "comment": "Malware payload", "value": "e5fd25be80496ebe8a6828535b40cc7b8354d825f9a012d57c72176475cf3d61", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689780462, "uuid": "c49f5930-7e6b-43d6-b19c-a2d8536e408a", "comment": "Malware payload", "value": "f843fc869455bcc66699bcfdc21950badf6e27b9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689780462, "uuid": "a30169b3-ea14-46e5-accd-67171998a002", "comment": "Malware payload", "value": "5615034c841312ce50babe6d1d53df2e201f786aa77052c5810db6bbc5cce865a2fefa1885156d9479da87a73eea27c3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689780462, "uuid": "64504f82-3981-488f-8a5e-8bb82e0704a3", "value": "T196338D05B2E0C0B3D5A7073519AD8622467FBCA29BF484933F9E064D5EB15D1BA3D3A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689780462, "uuid": "5dae2e58-674b-4627-afaa-69308f214219", "value": "b3c5e81c2a49c8b00d13a96c67599538", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689780462, "uuid": "0fdca8f3-bc04-4609-a71a-5dfafd18520f", "value": "768:YetFyI8dkbF78NeNj0BjbY3yEMBWFNKtjistyxdjqTtVQ98lm5OHzu0DhsKSg:YetF/jPRsPyD7qTtewLsPg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689780462, "uuid": "fd9c9025-0707-4cef-8ebd-14fe27776cd9", "value": 54784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689780462, "uuid": "9498a530-41da-4f72-b471-426607c7f3e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689780462, "uuid": "31eef6c1-6f98-4366-837c-a9763fd072e2", "value": "SecuriteInfo.com.Win32.Evo-gen.18011.18371", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4706fb86-25e0-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689735568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689735568, "uuid": "f892d38f-59e9-4c91-a0eb-e9a32e24320e", "comment": "Malware payload", "value": "2bfafff8500d1c529380706a96392e99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689735568, "uuid": "570065d2-98fa-4e44-a283-f1ca3d6bc9ac", "comment": "Malware payload", "value": "e6221ef22e7db258adc8a211b56263d51749eb581f1b75a05ec6140bf5877db0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689735568, "uuid": "513fe48b-4eb0-450e-a80a-5c59bf987942", "comment": "Malware payload", "value": "e03b2a9e715b8f88b3258db243cc5aa6d5b68d74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689735568, "uuid": "58b0e751-f8b5-41d9-9d4f-b63bf76fd92b", "comment": "Malware payload", "value": "8079f8e5a0f4f175a33103edd6ef1668b67e1a90f16bbc6f211f3b104110df17400e5814d4310472ff93b511e51dcbb3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689735568, "uuid": "84e615cc-5be6-44e1-8375-380ea3f93a12", "value": "T16266332B3A354692C004E076D95E3F4C6F04E3753E609AC1C65FDE3BE6CD89A61E31A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689735568, "uuid": "efde92bf-e080-469c-b76a-28b95cff802d", "value": "a94549878c259a0f21633bf9ee3fa800", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689735568, "uuid": "f1e37821-125e-4009-b13e-fa689dd8a98c", "value": "49152:KRPHmedH2Zqnp0YZQrpg+sB6syKNxFYVmFORYYVOPFjgniur1W:sm02ZYp0I9+M64yVAOeYVOPF0niuhW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689735568, "uuid": "75d15b7f-64f8-4934-a0fe-4d819b35ab95", "value": 7065444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689735568, "uuid": "7929ac20-e34a-4e53-ba27-572706a5821e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689735568, "uuid": "36867c38-6118-4294-aa8d-e60dc49e3146", "value": "setup-rc17[1].bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a661fa08-2610-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689756344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689756344, "uuid": "e57a4032-5df6-4230-9eae-8e36981d8407", "comment": "Malware payload (AgentTesla)", "value": "0852c55afb07f448881368977a5c6698", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689756344, "uuid": "8ffbd4e6-222f-4b3b-b0b7-7997c718c837", "comment": "Malware payload (AgentTesla)", "value": "e69231d09aa6338043c6abeefb3fa648cd790c9c22ba97621e16f7ec1653f93b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689756344, "uuid": "fb42048c-cdf1-451f-93dc-a25493e65133", "comment": "Malware payload (AgentTesla)", "value": "41fb58d3ed5aa295a2e8d55cbc04c46e1debedc1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689756344, "uuid": "f2d8e8cd-f648-44da-8ff6-6e72b79f1896", "comment": "Malware payload (AgentTesla)", "value": "a1a0727e31ea6cddf4061bc3089046f972b4652288f99106e0bfcaa2cc21b1d687e7f02cab088fd66aa52c27968655f6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689756344, "uuid": "ce4b58ad-18be-40ab-a63f-3b583ccabc5c", "value": "T11AE423F1E186737CF3877705D95FF00EAACB025892A7345E68964E412B3E00B4E6B5B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689756344, "uuid": "59d8dff6-ba8f-4a39-a4b4-6254fd1c1b67", "value": "12288:tSZ8qZmfmawi2F/mmTq8g2PhElKl9C5H68tLgcfCnuXxkEFIhk:tuDZB9iOrTb2mkfMutFIhk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689756344, "uuid": "46573aff-4bd8-4e4d-9dc8-8272a0b661a2", "value": 664858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689756344, "uuid": "cf923741-3d34-47ed-9c48-be0525cc8a8f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689756344, "uuid": "498190f4-1031-4379-82a5-9fb8b92888d8", "value": "MP-A092.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed400b00-25fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1689747873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747873, "uuid": "dd71000f-d553-4caf-9f02-083231069da6", "comment": "Malware payload (DarkCloud)", "value": "b125a6ec2422678115c10319db95e8a9", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747873, "uuid": "d2f6b4f1-edf6-416b-83fe-6993c2d5c682", "comment": "Malware payload (DarkCloud)", "value": "e708bc49e3be183622e9741f408794c4ef83761d3d9f243dcef214e6ece37aba", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747873, "uuid": "b9fd3987-ab67-4a9c-96d4-273ef76c822b", "comment": "Malware payload (DarkCloud)", "value": "0290a4ffb50f159a368c2039e64ea6672a3b441f", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747873, "uuid": "7f57c1d1-9716-4266-a609-c90b9aa67752", "comment": "Malware payload (DarkCloud)", "value": "ac9f5a2de30de7a2334cb1471c48a623a06f4d72319178fe3e97aab24101c3fcd70d8ccff5dbdba40e1b959452b4924f", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747873, "uuid": "490ae3cd-a2f9-4e3c-a9fc-17f5ea9081d5", "value": "T1E545E003D8049BC7D40D83F47E530EE90F0AAF19E899BDEB10537F8B3A71A62595A51E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747873, "uuid": "8bd61614-7ee9-418c-98e5-304769c5b799", "value": "24576:EDu9V1ZyFw6VPAZyPw6V1QpbFcwTA5S8cNfnwCx:EDu396VPyz6VQFjTBNfnx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689747873, "uuid": "2c28d6bc-1e27-48e1-8c86-93a73838dfb4", "value": 1211904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689747873, "uuid": "f4e9892d-2157-41a3-8f7f-4b5b00145a6f", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747873, "uuid": "274ab222-cdc3-4129-9b28-8f802af21b83", "value": "Attachment.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68100420-2627-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Hydra)", "timestamp": 1689766118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689766118, "uuid": "cca30927-c61d-4d7d-bedb-0f3228b1d607", "comment": "Malware payload (Hydra)", "value": "786612ce5c6cd05de4a5cf495bf78932", "object_relation": "md5", "Tag": [ { "name": "android_hydra", "colour": "#626579", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689766118, "uuid": "691ba955-c2d9-4c10-9d7c-50430b882987", "comment": "Malware payload (Hydra)", "value": "e7235288be3331c796b3ed254f33f66d935220ed1074df1a9eb32188d5ca8994", "object_relation": "sha256", "Tag": [ { "name": "android_hydra", "colour": "#626579", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689766118, "uuid": "3fa82d86-e0fc-446f-9d1d-0accbe9b989e", "comment": "Malware payload (Hydra)", "value": "9ce5fb885666d17af9c65cdec8eda56f96b1ff76", "object_relation": "sha1", "Tag": [ { "name": "android_hydra", "colour": "#626579", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689766118, "uuid": "36b7d54e-8323-454b-8d18-8ff4b0ca5a5e", "comment": "Malware payload (Hydra)", "value": "924e4a8529216e4eaf21f62a1183566d88f73762d5969273e4f0240dfa4b57a76206073bf49ecb7f28e347186b5caf2f", "object_relation": "sha3-384", "Tag": [ { "name": "android_hydra", "colour": "#626579", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689766118, "uuid": "e1c3370b-c297-4a21-a82d-4b28f73302b2", "value": "T1C4163314B8C49B97ECBE17B5DD9D4951523A2E45EA53D20B3029B30D04B38C0DEEADBB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689766118, "uuid": "4b334ddf-22f3-4cec-abb7-6378973d57a6", "value": "98304:Fj7ccKpV3K0MPEjrT7cz5uIcCSO0YFxEnJSl6U96BU5:1Acwb0z51x0JJSNd5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689766118, "uuid": "60400b04-93a9-4d3c-ac24-af073d0e1855", "value": 4044270, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689766118, "uuid": "a846e100-0fde-40bc-8960-da3fdb1ba454", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689766118, "uuid": "4bf374c6-1f36-4e9a-aaa0-6d778d966032", "value": "2-aligned-signed_en.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0257d9f1-262c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689768095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689768095, "uuid": "facdfeb5-370e-43da-98af-eadd758ddd22", "comment": "Malware payload (AgentTesla)", "value": "fda603131c10380cf874e05d53be1f35", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689768095, "uuid": "e9303a85-3112-4e2e-af39-51c5609dbc5e", "comment": "Malware payload (AgentTesla)", "value": "e82233d8041e8cacdb411541d1fb569b1758731bb4a830c61bc0396f12e05286", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689768095, "uuid": "7b3b15bb-86d3-4b21-8e95-f04a5e46e5ff", "comment": "Malware payload (AgentTesla)", "value": "ddfa0035574f3ef913b76f5fe67523c649e03b0e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689768095, "uuid": "87a8b8f3-151d-45b5-a2c4-14a9d242305a", "comment": "Malware payload (AgentTesla)", "value": "fd6fa36c599b6e4e4d29ef633ede31891280cbd7569a9315091bf357bbd7c19070b4849090e057cc2dbca97a2caecac2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689768095, "uuid": "c9ba8699-ba1d-4fb3-b750-ecb5b5d02a27", "value": "T1C9C42363A1BFE1438D8256A8B99D4CCC36B083154E1BABF9F4538B840D95C6EF747C46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689768095, "uuid": "8e1eb94f-7a65-4a6f-b19a-585702195587", "value": "12288:F6KMbagD0R0uSh5rbtEe3UDbGJxyoVZ8P8OWE74bQ:F6K4ak8vqNDqcPVc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689768095, "uuid": "8fb45685-a130-40b6-9201-adcc5f220bb0", "value": 581903, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689768095, "uuid": "5b596cc0-e985-4b2a-8f34-91dbe7f2d3e9", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689768095, "uuid": "eaed8b83-8878-4465-a465-8ad5285bea32", "value": "Quotation.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f296c28-25fd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1689748038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748038, "uuid": "687ee376-637f-4da0-a160-46c3feff9f53", "comment": "Malware payload (DarkCloud)", "value": "f1705dabf3d9b3d34192069fe94534ac", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748038, "uuid": "4a77b08f-5e99-427e-a52e-55adb2d56ff0", "comment": "Malware payload (DarkCloud)", "value": "e979a86de44a4a049bc52e49ba1122be4f7383f27f05893c300b108d0c725473", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748038, "uuid": "a4483953-f19d-4653-b0c3-82897c8d3f26", "comment": "Malware payload (DarkCloud)", "value": "314ea9ff47d3b5dbd02e5939ec4591235bd7851d", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748038, "uuid": "27163f2f-bb01-42b8-9b86-3a1adf095400", "comment": "Malware payload (DarkCloud)", "value": "eae3f1c57f5a42f0f8c09bcd3e78dffe2218d98b0dc80e36accc24b218d5b70c8b3447410655ea1f8fdf993116c65254", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748038, "uuid": "80d0a435-8344-4e3b-ba94-f92d867b3b84", "value": "T17B1523642CEBE957C12B1FB9001217B14A118BD5F566CB630C8EF0F6BB69B4E8E21717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748038, "uuid": "20554e4c-0b19-4e84-b4db-b4731e833ac1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748038, "uuid": "536defdf-9677-4e43-bb10-7fccfdb91d72", "value": "24576:AN6GEfLUBuad2liHWZeUoSBH8pUg7iYvLBxhUu:86hfgyliHfRSOpT7iYPqu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689748038, "uuid": "cecfe15d-e52d-491a-8b78-6e2346f24ace", "value": 891392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689748038, "uuid": "69122c9b-51eb-466b-a1b7-4bd62808b06f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748038, "uuid": "cf255f62-1b9a-4770-aa2b-75c984495486", "value": "DHL e-Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa242953-2610-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689756351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689756351, "uuid": "b2e06a68-e372-4185-b73a-5900eacbd773", "comment": "Malware payload (AgentTesla)", "value": "d872b3aa477b8984d4d5658b9fec9451", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689756351, "uuid": "b9c07e7c-46ed-4889-a277-c246c9d0ec4f", "comment": "Malware payload (AgentTesla)", "value": "e9cb510832b3b160bf13dfc363895802d0febe7b21d290ebfbb9292843996b02", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689756351, "uuid": "9b0c9c42-4ef2-49eb-ba17-fbc70df53713", "comment": "Malware payload (AgentTesla)", "value": "2532e33f9f14cee8770586b33993b51b8582d2ad", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689756351, "uuid": "c21e7ece-fbe1-4a54-8a56-8cde87fdc566", "comment": "Malware payload (AgentTesla)", "value": "300ad7b670b2cc8f6cc362270abd69a8099551fa760f69b1cb4053199571ea6b8c31394b4df82d8b53fbf31067242eda", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689756351, "uuid": "f5ea840d-fd19-4b16-a5cd-a4d48d36bb6f", "value": "T192158E0B39D02A47E42E427E547C6A6CEBDED20D466FD968382DC2A3B2F654C1D4D70B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689756351, "uuid": "ab785c3a-5bad-486e-875a-11dde0096f42", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689756351, "uuid": "d1672408-be63-4b52-b708-94f4f6673f03", "value": "12288:blWmGii2n3EmTk8gMPhElKuxVFGQIut7D2G5JKT5b4j:5rRiitT12nz76x4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689756351, "uuid": "41b5b8ce-09a0-4da8-b4db-9c12dd5e2072", "value": 877056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689756351, "uuid": "a6616eec-331b-4abe-b05f-9c994fe20a9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689756351, "uuid": "df5fb698-d5e6-4de7-a9e2-0117ddc4b5bf", "value": "NKN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39657ccd-2616-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1689758738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689758738, "uuid": "47841534-b57d-41da-993f-ead386b18061", "comment": "Malware payload (GuLoader)", "value": "7c8d252ac42e808aa7cfa56e267cfbea", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689758738, "uuid": "8ca9aef4-5af8-4583-8e2c-e74fcfcb19fc", "comment": "Malware payload (GuLoader)", "value": "ea47b1f978871bb0f809619601704afc5b57ddce4ef9e82dace818d2691d9ac5", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689758738, "uuid": "a9363883-21d3-485c-a58f-0f192d7987f6", "comment": "Malware payload (GuLoader)", "value": "c8f04d03145f2b33a99cf74ec53c956f4b975237", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689758738, "uuid": "89be13d8-83be-4b51-b960-c78abcc64ced", "comment": "Malware payload (GuLoader)", "value": "10e8d34e6ef317022c5d2ebb5015450a071d511e67a9af8b002a6ae61de7e8ff5c24c9b192155036213517b86284b9a2", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689758738, "uuid": "2ab30603-3f7e-4d2b-ba59-dba4700bf198", "value": "T1C9452382A2F5805AC8604BF488366A174B569D367834DF6F738DB7DD3F321C1981B74A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689758738, "uuid": "fb4df4d4-8622-4657-8769-78a8f8a22e01", "value": "12288:ugW9P6ecQgjD7RCCTtoBvLOiEGykE6tKds5zYfePCCIGNgKgD:G9Pr6D0CTmhOUGs5MGPmGNghD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689758738, "uuid": "81575115-f8c2-474c-82bf-3143e57d17b9", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689758738, "uuid": "fe479daa-7df8-4333-9dcb-93abc662fea7", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689758738, "uuid": "8c9543ab-623c-4e15-80b5-57c575d4492e", "value": "Waybill.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05177298-2686-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689806754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689806754, "uuid": "fdf38f10-f20d-4fd7-863c-47bd253ac4e3", "comment": "Malware payload (Amadey)", "value": "805f48783d32e36b797092ac55536d8f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689806754, "uuid": "729e07aa-fe8b-4d00-b60f-7f4f6bdee9b7", "comment": "Malware payload (Amadey)", "value": "ec00f5b3ff9be2f07ccb3c82fabee1c3f15c19c7d0d2a4c8f4cc3d45f4bd27d1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689806754, "uuid": "21b566bd-edac-4836-8839-a05186ffc962", "comment": "Malware payload (Amadey)", "value": "a6296bc21be6806e2004c0058e3e8c91ddb6b88b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689806754, "uuid": "9380768a-3455-4840-bd6b-464edf966f2b", "comment": "Malware payload (Amadey)", "value": "c68b68456809c55ae06aba69007fee6892dcb1308955fc961d0c89a13e9e5304e0291ecb1e858e84026da2cc84ded4b8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689806754, "uuid": "a96bf9c7-8b01-459c-9551-9fb1a4cf9ab0", "value": "T18925DD9D765071DFC86BC472DAA81C64EB61B47B931F4203A42722EDAE4D8A7CF141F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689806754, "uuid": "c5464a17-c9e5-4ab7-ae6f-61ba05149448", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689806754, "uuid": "f3401cbc-3733-4ea5-b44d-4e32df1d3ddc", "value": "12288:DfBFflzMn9n0LiAaLSvtYLeMK/PdsExmNuCRu2WjiTup4Azft2SGd4WNy3ZQ/Lqk:DD2ZSMWtPdxUIou7zZYP75", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689806754, "uuid": "094fadc8-caee-474d-a0d6-3fd1a4915bed", "value": 985144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689806754, "uuid": "66525c9b-7eaa-4f15-bf35-2b357aa9b909", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689806754, "uuid": "f377ee63-158b-40c0-94b5-0a535da20dde", "value": "805f48783d32e36b797092ac55536d8f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "416b34ff-264a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689781086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689781086, "uuid": "6b6172ab-c5a7-4c5f-a071-03022512470d", "comment": "Malware payload", "value": "41920c24a3e2dd744b858d5d834d321c", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689781086, "uuid": "56e4e32c-f2f9-438d-8abf-a8cc14d1193e", "comment": "Malware payload", "value": "ec615f804072c8d7d8f06a9e92dba5ab10bea7e30e7d302241db1b86ad491b15", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689781086, "uuid": "4e79c69d-371c-4680-a248-ac60186f1f31", "comment": "Malware payload", "value": "5f5ac193a39c4ba26a90820f0022d0717108b9c1", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689781086, "uuid": "b42f0b83-a8d2-40ce-9261-b82aadd28573", "comment": "Malware payload", "value": "2f641a0272e72c67d0ded3663d866976554884910619bbcb32279ed633d1c329bc4af77f4dd498b73f5ea80e60287130", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689781086, "uuid": "7bf39a3c-7619-49e4-86f9-e61369ca932e", "value": "T1A503E1A0510424DC9327D5B2AFE9552268CFA05262EDEA32364E85C34B02FF77B8C797", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689781086, "uuid": "1b3f05d7-8aee-4e86-9ec3-8e6673214f5e", "value": "768:1EYYDlfn/NGWXYHt2dzrXTlgQguoxkTykV52A+KJrXiTC0L2qAB:1EYEf/1XcCTlgQg6TZeLKly+0po", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689781086, "uuid": "a2790d36-19a0-4e27-b2aa-d6d93013c21e", "value": 40757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689781086, "uuid": "935381ec-565d-4c17-803e-b9a1ce0c4700", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689781086, "uuid": "53fc952b-eeeb-4d50-bd35-e6866472e655", "value": "PSI1920KA9D9 (2).pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "333a25d3-2632-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1689770754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689770754, "uuid": "5ba00294-e0ac-4440-81fe-c20f27f07f45", "comment": "Malware payload (SnakeKeylogger)", "value": "989422f879750f025f62576fc6bb3839", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689770754, "uuid": "4917e8b9-9722-4757-a421-6ea296ea7a75", "comment": "Malware payload (SnakeKeylogger)", "value": "ecd24005f85411e22ced38e6c7c8cc23395295a3ccf607299dc82058a5125e07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689770754, "uuid": "1c2493f9-9c80-4dba-a5dc-e1dc7ea92749", "comment": "Malware payload (SnakeKeylogger)", "value": "a7d2a8943b026fd82771b1ea982c1374b8075880", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689770754, "uuid": "e4db60a0-6453-4236-a6f0-a1c34cb05e8e", "comment": "Malware payload (SnakeKeylogger)", "value": "67b2dec94fa068913e26b76868cfc575bf2b6191f2cc9e2dc2949349c8e512b9a0200b71d46b33ee585a5f0b04d9cc30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689770754, "uuid": "beb06fa3-5a98-47b7-aaee-6eb5e6179c55", "value": "T197D4021076A4D713C2A4CBF91764A74427BE9FDC20E0F11A9EEBECD671A5B140D80E57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689770754, "uuid": "9684d17f-e9d1-49fa-b32f-8797aa6a5abf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689770754, "uuid": "22523eef-0a22-4144-b1a0-be0fe46b2852", "value": "12288:q1PYPfY7bPiZMTjyC4CHOsH+yB7Li/EWxW0HBC4ZWtkwbYrp:iPYPgnPiuHLFH+yBfiMGHBz0uuY1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689770754, "uuid": "8452ab24-619a-410e-85bb-b465686fafed", "value": 602624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689770754, "uuid": "4f403e9f-7cdf-4cc9-ae4c-d311dd66b52e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689770754, "uuid": "f9f1dc01-77bb-4ecf-a044-07705b607aec", "value": "RFQ 94844.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "391b1c87-2633-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689771193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771193, "uuid": "61275683-afd8-447d-a688-358e0a341d3f", "comment": "Malware payload (AgentTesla)", "value": "f285ab92979983593c430a2216d293c5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771193, "uuid": "f6059edc-28f6-4380-9a16-af7da42a8d99", "comment": "Malware payload (AgentTesla)", "value": "ed39354cc9cf8575417f0d810b93036e8e51c078e92195b33a44e4191c24e66f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771193, "uuid": "ce123a9d-bd74-4038-8d1d-60080176a763", "comment": "Malware payload (AgentTesla)", "value": "65bb8e3a6ec5dfe74d512b9a8d2815f6e9ec838d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771193, "uuid": "68bc687d-2e9f-46bc-9549-479df72106ca", "comment": "Malware payload (AgentTesla)", "value": "71515b9390577891b8598c86a6c10b7875b7476716c7974b4f57d3b18296b3147de5d14e75ebc621251fa526e6a143d1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771193, "uuid": "9fbc2699-8d69-42e7-89b1-bd9dcd9d9d52", "value": "T1F3D42352D6CCC12BDDD246F0AB3AEA9946314FC04479C10D9A4EFC62FD8B74266A47CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771193, "uuid": "f959c8fb-e991-4d89-a0d5-a679c5582c97", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771193, "uuid": "c9ab2fd2-9fdc-401d-957e-67a8eb27252a", "value": "12288:Sfb/WT4UkuZbeYF5l7tjhF2UihXeNdk9Tt8He3PmmJCBPRptYyovX4:SfzW/ZbtF5lhNQUhoqGU7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689771193, "uuid": "4cef1d03-3b14-44cf-92e1-0fd2f146280d", "value": 607744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689771193, "uuid": "950fa30f-3221-43e8-adcd-2fc974000402", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771193, "uuid": "2c72c61b-6c98-44a3-b2b1-e4020e7d9e70", "value": "Best Price.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30e8457f-25e5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689737679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689737679, "uuid": "bbc522c6-6433-4f0b-89bb-5c7d97281bab", "comment": "Malware payload (Amadey)", "value": "2115f838100aacbc3124baa1083c9d98", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689737679, "uuid": "8e03972e-956e-41d5-be92-88a85067db77", "comment": "Malware payload (Amadey)", "value": "ed835b70d57f3901ebdd0814415cbc64776d5bb9ee43a7077c0894540d7dde6c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689737679, "uuid": "d0d11a0d-df6a-4935-a941-7fbeef871aff", "comment": "Malware payload (Amadey)", "value": "7eb9e1272fdcbc6deec8fbdc06d609c69a0a88fc", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689737679, "uuid": "2288edf8-553f-4ef2-be9c-fddbe34e4155", "comment": "Malware payload (Amadey)", "value": "6dc2bbf32a71ba9be92f5a4b85660bd4c04f865d902dcf59ebfaa65bae9ca5dd101121328c016e0852d769714f12696c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689737679, "uuid": "da50be63-1136-4454-b20a-60901d8ee875", "value": "T1E4840103ABDC8132D8B52B7058F703C30A3ABCA15D74866B27466D5E1CB25D4A972B7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689737679, "uuid": "4b3c70d5-5051-420b-aa77-c86cc22baf78", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689737679, "uuid": "ab88fc41-18bf-4ba1-a14b-5605de57e98a", "value": "6144:Kwy+bnr+Qp0yN90QEHQvEyqANvRS5KRQrw6kd7lmm39LBGGHlXve5oGvAe:wMr8y90QEyqANc6Qr5KAm9HFXaone", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689737679, "uuid": "cbae20a1-c889-41f5-aeee-e8c680ff7ff3", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689737679, "uuid": "c46c9f90-c01e-4dd6-9be5-cb3d81a46c25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689737679, "uuid": "466b0713-d455-4458-8dff-db2218ebc7a9", "value": "B097.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2977eb07-2633-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689771167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771167, "uuid": "899398a6-50eb-463b-99a9-b5bb6665f564", "comment": "Malware payload (AgentTesla)", "value": "9a46c55afbfaafeb5a710975268f68d9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771167, "uuid": "a8c73dde-2e17-4066-b6ab-a92cdffb5359", "comment": "Malware payload (AgentTesla)", "value": "ee4f7a5d95e38e4ea5e0a7387ea99e0ef066f49261d685d5214f6e705d8a90e9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771167, "uuid": "b19fb013-7188-4035-bb94-3671e903cb86", "comment": "Malware payload (AgentTesla)", "value": "39f31f2c47e21899e7c6c915d046fe270347d8a4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771167, "uuid": "61929439-30d7-4f34-b2ad-08bfe725e159", "comment": "Malware payload (AgentTesla)", "value": "5d4b7898413bacdc80919dd8b0c726f9bb4e503cc5ba04032cd1c906f31eba69e223f3ea3161a6e67209639ff5bd523f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771167, "uuid": "066b3fbc-6741-4f72-b13a-7e5a5d89fcef", "value": "T19BC4F01CEAD48219EF5F16769CB8121CD2B9B45E1123D34BE8847EFA2B353A44CF1762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771167, "uuid": "58051ccb-4ecd-4dc8-a7c5-26b3179cb267", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771167, "uuid": "73b5a0f4-0355-4a77-b66e-9edf1a9151a8", "value": "12288:77u0EuGzcMz8Q+TjLGkzVaZpudWiE7++SiccCcn9+55j58BuAy6L:+0tGBoBT/FzVE0c7+ziclJAlL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689771167, "uuid": "e2027006-8bb9-4140-9eb1-6e2b7d59e1e8", "value": 566784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689771167, "uuid": "4a15e5e7-70b5-4e68-b5e1-a80744a43237", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771167, "uuid": "225b7261-3b73-4e26-a4f0-0b8b2ba75ce4", "value": "HSBC Bank_ Payment Advice_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18f9d4f1-2607-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689752242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689752242, "uuid": "dea34ad1-0ad8-4789-bc3a-cb5d81d7eb7d", "comment": "Malware payload", "value": "6ed71a5bc6e0c24d6bad213efd6d6349", "object_relation": "md5", "Tag": [ { "name": "Exploit JpegDrop", "colour": "#5F32C9", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689752242, "uuid": "f8000067-6cc2-4b08-a7bf-d3596789b227", "comment": "Malware payload", "value": "efa20f0295edf9ea8364293cb82f4c408dc89f6f4451a5736bc021d13f449ec8", "object_relation": "sha256", "Tag": [ { "name": "Exploit JpegDrop", "colour": "#5F32C9", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689752242, "uuid": "e32e5ebd-97db-4100-96da-f514aa2fabf8", "comment": "Malware payload", "value": "59f252310bd9aacc4e219d3f3b374532c7176b4b", "object_relation": "sha1", "Tag": [ { "name": "Exploit JpegDrop", "colour": "#5F32C9", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689752242, "uuid": "69eb1019-9268-443e-8aa1-5a2c0d8d4490", "comment": "Malware payload", "value": "6b92104d222393f3c9222c8d6833e0d4d8886014e1661c5ba64c6ae67dca4f820a170e9403a44a3f94d48a975706e5d6", "object_relation": "sha3-384", "Tag": [ { "name": "Exploit JpegDrop", "colour": "#5F32C9", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689752242, "uuid": "e958c609-2956-4ba8-b169-9cdabcc9d3f1", "value": "T15E65AE0AA3A941B9E0BBD174C957460BE7B1BC021770D79F13E06F9A5F63BA15A3E310", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689752242, "uuid": "666e5f3f-7a0a-4a5c-8562-f27322fccdaa", "value": "24576:SMaEt+i3CaSEKFaGWWEfpVk3XFc8ZSK10CGWQw6tsJCetgJlfpsP45:SIoigCWERVk3XsgQw6jeU2PY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689752242, "uuid": "76949c82-114f-4849-887a-58b0ccea4349", "value": 1506508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689752242, "uuid": "ceeed2cd-d00d-408f-9497-6ef1e9bf0c24", "value": "image/jpeg", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689752242, "uuid": "7c877cc1-fba3-4702-91c9-8f3d2164faf9", "value": "imagc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de2284d2-2632-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689771041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771041, "uuid": "f0f85391-5eb7-456a-9cf2-33dd9feb8660", "comment": "Malware payload", "value": "a80b962767327854bbedf48dec54249c", "object_relation": "md5", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771041, "uuid": "31dbba15-0f59-4941-8deb-64da2d11efce", "comment": "Malware payload", "value": "efcc550dd777e23a99efeb8fdc8f07fcd79d50001fe1c640c4a318717e771cc7", "object_relation": "sha256", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771041, "uuid": "fb19831b-5b95-49e4-b381-9e8eff906dbd", "comment": "Malware payload", "value": "4e9af38820e5963ad1f8d6b5c7520318038541f3", "object_relation": "sha1", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689771041, "uuid": "6182eebe-2232-405b-be5b-487b50c0f411", "comment": "Malware payload", "value": "7611483666852ed80a089c7e61c0a140d8ea897de58cf931b34d2e5d7d06878cbffa294ea1bb93023e81993e6dd214a3", "object_relation": "sha3-384", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771041, "uuid": "3aaeca54-3a6f-4839-87f4-33df9f8ef355", "value": "T17594F000324C9D99F28657F979B6B18E801CBDB336D4A1C26BC8B30B9836F7B661B545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771041, "uuid": "08e93741-8c5d-48a1-b719-187e245f2f44", "value": "12288:FZoGWQmmme6v3QLQuEDWQmmme6v3QLQuEOBqCcGnZS8RgibZT:DWQmmav30x2WQmmav30xrBqCJdPbZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689771041, "uuid": "630b7a30-e81e-419f-b3f8-73487a1eef9e", "value": 434688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689771041, "uuid": "be1a8466-9b38-4f32-b2d5-c64d5e9c5f46", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689771041, "uuid": "bd66248d-9081-4b5d-ac74-ed23af04bbf1", "value": "cotizaci\u00f3n.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f47d7fe4-25f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689745738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689745738, "uuid": "1deaa2d7-429a-4840-bf87-f21d9d4f19d4", "comment": "Malware payload (AgentTesla)", "value": "ca5ea88c55fde8c61c78a6a266ccd82d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689745738, "uuid": "19fbdf19-3b4e-4eba-842d-ae3ba81884ee", "comment": "Malware payload (AgentTesla)", "value": "f00652598de28e9ba38c95325babca64796e6da3229306cb3f087ebdb64f9c87", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689745738, "uuid": "a0b5152d-dcce-40e4-a945-9ba44beadb71", "comment": "Malware payload (AgentTesla)", "value": "b4b26d789a14a3df0e83031ada74f7d5ab226154", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689745738, "uuid": "eb568552-e803-44db-8197-82b565f29f7a", "comment": "Malware payload (AgentTesla)", "value": "5bb8c554f64af207a6759a3bb61d112e02b72aad653ec60528cde2cddd50b8923d449e676ce58580ef30338308ae5fde", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689745738, "uuid": "113f70a6-d006-4ee0-9ece-2372a58513a5", "value": "T1FEF4F110726D8F13E8BC63FDA4249A1843F96E57616FD7484EC77CDB35AAF104A02A27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689745738, "uuid": "911a10ef-63da-4672-88f5-926bd8f53f6b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689745738, "uuid": "a8e8b5e2-14d7-4b4b-aef1-7011537f7c0b", "value": "12288:8f+ZIpcW9RoyJfb/WT4UkuZOB6yyiw71+IsNIirj2zl9gTPFnu1DTI3p41yRQC+o:8GmpcW9RoyJfzW/Z86yyjTQjC2T1uJT4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689745738, "uuid": "758b9228-ffe8-4831-bec0-4290b7652de7", "value": 751104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689745738, "uuid": "9add76bd-d32d-4c39-95b4-4e31d36703d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689745738, "uuid": "0898dcf1-5114-420a-a9ba-9b67da4a13ac", "value": "inquiry0259579.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0388a468-25f9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689746193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689746193, "uuid": "1f3dfb5c-4dc2-40f7-b6c1-f4e94b86a7e0", "comment": "Malware payload", "value": "995d9b5943c9dfc62358b43fc03ebba4", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689746193, "uuid": "25931df7-8ff5-434d-95c9-7cbe7e25348e", "comment": "Malware payload", "value": "f044f41a42acafbdec681455adb91b3c25de8cc815917f953efe9a326dbbd898", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689746193, "uuid": "a2685037-36fc-4a70-8b18-0f0fc65ef659", "comment": "Malware payload", "value": "5533c63d995ad3d7a704af136e5bafa8f4bcdeee", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689746193, "uuid": "ce511e98-1d32-4c08-9ea1-836f875d9233", "comment": "Malware payload", "value": "ec78b79698200de98e7d23c3a2772ef5ea0569700c86981fda5a28508639c47c00d59bb72ca9b59755895211a40de446", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689746193, "uuid": "99563e37-a5d3-4234-9fef-b43f289df3b5", "value": "T17D53AFF476409DE69F9E5B63A42D5ECC1615307FEFCA50CC1150BBFA2A633109A0E8E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689746193, "uuid": "92d6d981-d5d6-4eaa-b9ea-3b8b5fdaa5b5", "value": "1536:UUjjTPEY9YaHHE63DJGbRzJuPPcEqTgIYzgE3UtBxrSY/Emb19v77:UCjTP07EWE0BZv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689746193, "uuid": "f6f94eaa-1b86-4508-8c2f-ec0b044b4d6f", "value": 66138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689746193, "uuid": "4d3d798b-97e7-4dc5-a7c5-6e67db8d0c5a", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689746193, "uuid": "924f29bb-2c73-4bef-be1f-5be31d598fe7", "value": "SW\u0130FT fi\u015f-675432.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8d5d3d2-25fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1689747758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747758, "uuid": "41ff5fcd-0d00-485d-bf07-2d2a6b8eb6ad", "comment": "Malware payload (SnakeKeylogger)", "value": "809626e7218e41dc9947c765e5181436", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747758, "uuid": "f834cbf7-9f81-4062-bf23-2829699da3c1", "comment": "Malware payload (SnakeKeylogger)", "value": "f211c5dc5c79821bc6b82b80ee62aebcecc3c85d758c3cfe87e9e47ee2179884", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747758, "uuid": "562e0147-de67-4024-b0a6-b01a7038ddee", "comment": "Malware payload (SnakeKeylogger)", "value": "db750ee340d8606df607cc6cc86d752de8e8c8e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747758, "uuid": "fc2b3131-bdcf-4572-a473-c83aa72d8cc8", "comment": "Malware payload (SnakeKeylogger)", "value": "8f982ac9197c2d87ef77bc0ead053e18bcebab65aedddcfad4ba75456e669978cd371349e84056288e50dfc23851f5ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747758, "uuid": "ca5c71eb-3e16-4625-9362-f360563dfd3a", "value": "T1FCC423041B9CC72BCAD053780B70B7525269EF8A6821FE1A9FC7FDC8B92B3501225677", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747758, "uuid": "0a1e4b1f-70d6-44a0-b7ba-ae029bfa6716", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747758, "uuid": "6e63233c-f0cf-487f-ad18-3a1055b6ec6f", "value": "12288:ZPYPfY72s39MAfoV+1gGmfOyPoA6h6w0concBwifzym:ZPYPg13ra+1gGmfHPopJ/air", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689747758, "uuid": "948041e2-20e0-4ab3-ad5f-54d2ec0bce27", "value": 594944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689747758, "uuid": "555c3c9d-1594-44e4-9586-bfb1d2335007", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747758, "uuid": "a5e634b5-f237-418c-91a5-27eef3ebf1d2", "value": "pago b5859.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f544e7a7-262d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689768932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689768932, "uuid": "1d13531b-a41e-46bd-9b72-547c7fa16bcc", "comment": "Malware payload (RedLineStealer)", "value": "e38a25843e899a667951413c11331319", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689768932, "uuid": "b970596c-d3e4-4486-974b-04cc3e49b944", "comment": "Malware payload (RedLineStealer)", "value": "f240fbc800410397cc4aa7db7f4121572f43268a24d1e29ce8dcc59b56f0a171", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689768932, "uuid": "e0e356eb-76f6-462c-9ada-d337de9631e4", "comment": "Malware payload (RedLineStealer)", "value": "13aa70e172cb361ff3cf5ee5c0190728bb6c2717", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689768932, "uuid": "dd87b6d3-52e3-461b-a4bb-b152b6fb1852", "comment": "Malware payload (RedLineStealer)", "value": "74636beb82e7a7d09b0cd45d9a7d9ac4d683cc2d88a2b282ae1be9c3f1db608b44d0b9f5754a0d4361ca9e99c9fe8868", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689768932, "uuid": "ba1d10c9-255c-49b7-8161-8fb2f2a4c9bb", "value": "T1F7840123EBD450B2DDB1177068F713C31E367D926D7893AF2385996E0C72298A47272B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689768932, "uuid": "38f62e9a-d525-456f-848c-5f648bb53d0b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689768932, "uuid": "7f5c01f6-66dd-4453-bc0a-4ff5227408da", "value": "12288:2MrOy90o3tQnD+0UaPczBS2O4KxI02U/:4yajUnAbfxI0R/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689768932, "uuid": "523d1169-c06b-4c26-9071-8bf8fe23ddff", "value": 398336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689768932, "uuid": "cf6bd734-11c1-4e0e-ae6c-d450ffe82d91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689768932, "uuid": "88219cc6-e7df-4193-893f-7a2d8eccb893", "value": "e38a25843e899a667951413c11331319.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa4f5d2c-2668-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689794147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689794147, "uuid": "f4dcafda-dc79-46d2-9a74-c0376a449e91", "comment": "Malware payload", "value": "dc732db906cced00659fcff347d791e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689794147, "uuid": "4f93b4e5-56c5-41d6-bd82-c29adc5b87d3", "comment": "Malware payload", "value": "f310f2210e10d016cd9e79ea07fa3bcc4f63436b9236b92bc628d60801ad8135", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689794147, "uuid": "97038ea7-6582-43f2-956d-c6c3a06897f6", "comment": "Malware payload", "value": "99f54cd437494af044059e38540bd7618039c657", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689794147, "uuid": "05b0c1ac-c653-4bc1-831d-f487b71f3984", "comment": "Malware payload", "value": "32878c58da6d436057182c2da5280e7966a5c930c24d1b00d48ec534fc87ae42975fd76d95ad1aa95d65aeb4f1192069", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689794147, "uuid": "3feb02d5-bed9-490e-ba91-9169bfa486f0", "value": "T14EB42391B2F8E48FF2811370393BA8466E5BBC376D3512570398F26DB973462642F726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689794147, "uuid": "ea33959d-965a-4f30-a746-33a2d78ef508", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689794147, "uuid": "9e726c5a-858c-401c-8e3a-718c1d1ff5be", "value": "12288:pgAYxRUiMoxa1JI8kUUD75KN41lz4T6XqUulmmHG:9YxuiMOEFkUm5g419U6Xolmmm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689794147, "uuid": "a29baf53-1339-40ba-884c-1ed75ecc2e97", "value": 506376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689794147, "uuid": "c043fae4-1151-4156-ab35-68fd3ab50f93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689794147, "uuid": "868124f7-2390-4753-a221-ef0a4103230c", "value": "Enquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8940a63-2627-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689766226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689766226, "uuid": "84c43ee9-b59d-4231-adc8-6b6bbbafc6d0", "comment": "Malware payload (Amadey)", "value": "72c3255fdd8470ea2019dc7d4dbb8674", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689766226, "uuid": "5eccf5f6-be9e-4ada-9436-2e003f1dd788", "comment": "Malware payload (Amadey)", "value": "f399dac32a7936451d5d3219a7c6ad9375b97ca7d5401a6c60dad5d30481ff5a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689766226, "uuid": "67131009-04d4-4f62-ab9c-1b1c592142a9", "comment": "Malware payload (Amadey)", "value": "5b859492d86ea7214e449728280033568f0c0a6d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689766226, "uuid": "32af1566-da1e-488d-a265-3aa0311428cc", "comment": "Malware payload (Amadey)", "value": "a0d7f565d7c5611dee16f198a0207917405b297fd957348dcb6f394b178414bc08c71e8fb56348046a585a2f45a46a36", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689766226, "uuid": "39246878-cb39-498f-b4de-c5c57694cb54", "value": "T1BA840252E7E8C032E8B517705CF752830F3ABCA09C78936B3396984D1CB3694A57276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689766226, "uuid": "ec3af7a1-baa4-430e-b1da-e02822492970", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689766226, "uuid": "d6c6537e-e422-498b-b33e-8c2c0733d519", "value": "6144:K1y+bnr+2p0yN90QEi5kpBXHVS9PEHfSTZkuSHwwCcHnlRHEqP8/eA6jD31d85e:3Mr+y903+PEwkuSHccHnl9nP8mA4MU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689766226, "uuid": "601a62c3-9740-4fb5-afa4-fd650cfb6284", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689766226, "uuid": "dbf7b1d4-1882-414f-82a0-bfb4611c1825", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689766226, "uuid": "cfa6267d-5739-4c45-be5f-fadae3b17318", "value": "72c3255fdd8470ea2019dc7d4dbb8674.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2adab435-25fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689747547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747547, "uuid": "a0ccbe09-b3ea-47ea-9fb6-1a6edb15f2c9", "comment": "Malware payload (AgentTesla)", "value": "29be1156da61716343d631be276b3c77", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747547, "uuid": "08541d5e-4161-4e7e-9e51-5d34c65ad2f6", "comment": "Malware payload (AgentTesla)", "value": "f3b9acdee2739576141f5ff93dafeedda8dc1205a880e4294810a6d741ba65c1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747547, "uuid": "113d0703-d2eb-4500-bdbd-315e0474e2b6", "comment": "Malware payload (AgentTesla)", "value": "0a822ef4d6ffd12532a606ae2b063cd3ad2b5881", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747547, "uuid": "10b80273-64ae-452b-a829-9df4ebae203f", "comment": "Malware payload (AgentTesla)", "value": "b0b61da6155e4337d78035783b9b84704e69ac4f8769fae832e17ccaaeb384ff1ee3bc3395a2caabee48254480a030a7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747547, "uuid": "9f77b093-f499-4d2b-b903-b332416a070c", "value": "T151D4D0503B2ADF25CB6943B6561783A463380E09B64CED3436C3769C04FB6E29753ADB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747547, "uuid": "d9eb25d2-4862-490b-af4a-3d3550c72b9c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747547, "uuid": "bfaf0c6c-af2a-4f39-bf9d-af9ea4427729", "value": "12288:AfFwBOFVWB7gK2sR/Dum0BbpVd945dNxpuMgkkP:AtCCkB7gT2LcNEBxpngd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689747547, "uuid": "f9e3293f-7d61-45d5-9b65-e3a9b6ce8e3c", "value": 653824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689747547, "uuid": "102f0c92-561b-4539-be6f-7e3c27553c33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747547, "uuid": "0021653e-707e-4380-b5d2-edcc547f5695", "value": "Scanned_CORRECTION-AMENDMENTS EFFECTED_SHIPMENT DOCUMENTS Tuticorin MV GRACE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73dcf446-25fd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1689748099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748099, "uuid": "8dfdf6dc-541f-43e0-bb11-985d8ae52ee5", "comment": "Malware payload (DarkCloud)", "value": "7813caf0ce7d7cb94fc40eb0416305cf", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748099, "uuid": "86487a79-d5cf-4cea-a2c8-0f0d88566385", "comment": "Malware payload (DarkCloud)", "value": "f3ebad7ef91810023cfafc2074096387baf8812681fee4401ff9cdb074ee6837", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748099, "uuid": "639bf143-9902-4d3d-8797-623fe94cec6a", "comment": "Malware payload (DarkCloud)", "value": "5be84744af23c69824ae9a7d8100f46258136d35", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748099, "uuid": "0b5186f4-6807-4f14-9f57-e0d1ecace574", "comment": "Malware payload (DarkCloud)", "value": "a7e7589b4d8671946fb3908e5758a2c88e89095d0ca982d3f6b315e1d10c0dedefadbdea56a57456e6d2409bd927621b", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748099, "uuid": "091e9868-9ff5-4788-a403-8949657401bc", "value": "T1C29423206A21C843E9E14F7619BE55E9AFA27D0504F25A8B23102F787C5B516CD2F7F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748099, "uuid": "582e97ed-6528-44cb-b10f-a2e13084c41d", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748099, "uuid": "fc3da449-f37a-4f08-a339-bc394080975b", "value": "12288:/Y7nCoCubRtvZJFUcY4FrKcBY0Q1YoU/bn+F5+qWgB7:/Y7CD2ZJFUcPFrKM+1Ydn+P/B7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689748099, "uuid": "ec528850-3cfb-4951-825c-62652fde36c7", "value": 419871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689748099, "uuid": "51edd9c6-6ae9-4e4e-a140-12189063a128", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748099, "uuid": "c391b8b3-fc92-4487-b376-57ecb27cb0db", "value": "Quote# 1193353.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fc7da7a-262c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Hydra)", "timestamp": 1689768144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689768144, "uuid": "e67382b1-fa57-4c05-b000-7e2ea496329b", "comment": "Malware payload (Hydra)", "value": "0dddfbb03cd2c25201f93c9fcf1484a6", "object_relation": "md5", "Tag": [ { "name": "android_hydra", "colour": "#626579", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689768144, "uuid": "ea393e25-bf39-49c7-9c23-952178edc365", "comment": "Malware payload (Hydra)", "value": "f49e1713594da76ab2beb1aee8d31edf634737273b711fd6519137b1a39f8016", "object_relation": "sha256", "Tag": [ { "name": "android_hydra", "colour": "#626579", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689768144, "uuid": "d7de4e32-e8fe-4f5f-889f-caec42c98647", "comment": "Malware payload (Hydra)", "value": "d13884961583fb324db6740678521fe049cb5fba", "object_relation": "sha1", "Tag": [ { "name": "android_hydra", "colour": "#626579", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689768144, "uuid": "f9b0e513-c677-47b4-8907-852f13b86da3", "comment": "Malware payload (Hydra)", "value": "b4563ed1160a4b067c4dffa7521f22219f5c98150cea2ccc0fad0be54b679f6fe9946c2692271a105305ceaed23a6f3d", "object_relation": "sha3-384", "Tag": [ { "name": "android_hydra", "colour": "#626579", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689768144, "uuid": "d2cf4141-ba42-4673-8334-a9d9b02cba91", "value": "T166363306A66A10A5C7DC36728AEB47D5E94C6F8C4502D527133375B81C7BEC02BEBCAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689768144, "uuid": "0511f4b7-1c1d-499a-9683-4228ebc43f64", "value": "98304:3WqRJg9+njZ2Va7Al01oWcwWWIy0pP0AAfNfhZm9DcVlZ:3WqdjUVa7Al0KWcwUy0FGlhZm9DcTZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689768144, "uuid": "a52fa663-cccd-4da5-96f9-b86c76ae6ee8", "value": 4895531, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689768144, "uuid": "1932eccf-0d07-49b3-a33c-cfbc884e82f8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689768144, "uuid": "ac8f50a2-d077-40f6-a6e8-4a652579687f", "value": "BawagSecurity.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b27eab7d-2680-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689804468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689804468, "uuid": "3f65237d-6abb-455f-bce4-ee6912c763f7", "comment": "Malware payload", "value": "b5c11d627a1ce8ab1e64fe575af68024", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689804468, "uuid": "4cd91762-3dc1-434c-80c6-fbe5c4debbda", "comment": "Malware payload", "value": "f4c0309fc66dcc93076769b793da16c2df3dd125fb0ac13b591f41a55a5078a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689804468, "uuid": "e8f1d044-a43e-41e1-b18f-54a22a886bd3", "comment": "Malware payload", "value": "43e8fa15acdff8e58a1cf07ee584fcb1de61a03f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689804468, "uuid": "bb1f8c97-3b4c-4d72-85fa-6b14e01ee258", "comment": "Malware payload", "value": "0eaf09c7f3cfe32c65a0ca58893019248139850c181cbe506ac9aad71a266e27598138512aea83a809e542fc32dce038", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689804468, "uuid": "cedd3207-5ecc-45c2-89b3-a8bb9ab2f01c", "value": "T1B17633A4F5EFC7F3C5C14072CEBD389AE67AA5205FB50DA753504A5A6C3E291A012BCC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689804468, "uuid": "9a203f5f-249e-4822-b4b0-dfd3f05c435c", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689804468, "uuid": "d8385110-21a3-4534-a8f3-628df550ad82", "value": "196608:91OTRJWwruJxLjsvbvbaifaJdaLnMVHAlML:3OTbtrufLIDNf2gDMdAWL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689804468, "uuid": "2c457330-9052-43fe-8c4d-b0ba293794fb", "value": 7612689, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689804468, "uuid": "9a3ea498-145a-4aa5-89d1-0d9f5499a0f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689804468, "uuid": "9a059605-0b9a-41b4-a9c8-9c7be262b4de", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d80bc28-260c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1689754531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689754531, "uuid": "1f237139-2aec-4f54-9cb0-5f3125daafb9", "comment": "Malware payload (Formbook)", "value": "52c0edabd1cd9f164c50e281f1b10e13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689754531, "uuid": "a3195890-7545-458a-a222-c1723b204c95", "comment": "Malware payload (Formbook)", "value": "f51c9c3a2de03c31cb595b81d379885e673fa139d85089f789ad94d0966c629f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689754531, "uuid": "09898b55-82fe-4837-a16f-033685396927", "comment": "Malware payload (Formbook)", "value": "f39ebdb44a84eae7295c9c5207765a25a80ec299", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689754531, "uuid": "b8b58d21-983e-422f-a482-1bfe7da64bd0", "comment": "Malware payload (Formbook)", "value": "3d0e07cd82fa714368fdb02e388ff903cef36f2f5364af69910d9447b731ccfcf84268129a11f8a63e4d99ba51b37f3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689754531, "uuid": "032ec5f4-660f-47bf-8ead-88e17671339c", "value": "T138E412103EB49B13C6B9C7F91754A70823BA9EEC3461E26D8EEBECC6B195F150540E1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689754531, "uuid": "babafa2d-9d9f-48b4-b560-56bbcda9b04b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689754531, "uuid": "4573643e-a19c-4978-bbc1-57a2da6fb48a", "value": "12288:yVPYPfY7WXAN+2Su7MrHZr4RBwzX+I53URYcqc9Ng74quuu:GPYPgKi7SyPm+y3URYcDgNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689754531, "uuid": "6961949b-ccf1-4be7-a7bb-3c74cfd31eac", "value": 663040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689754531, "uuid": "66284397-7d4b-4c8a-b6a8-c61d016a6797", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689754531, "uuid": "56c36f44-68e8-4e36-ba14-4660567f7ed1", "value": "New Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a6276e2-25ff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689748942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748942, "uuid": "369822ef-83e8-4a02-9995-eae4c272660f", "comment": "Malware payload (AgentTesla)", "value": "a95f9a75b4460b7983279a879c9ec0f9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748942, "uuid": "f8441da7-63f8-48d9-891a-2a0c4150dacd", "comment": "Malware payload (AgentTesla)", "value": "f591f3b46cc1844550906abe587a1d82b96b37bac5621c1937ab8b0552258417", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748942, "uuid": "e032bd42-ecca-4df7-ab1e-1e0dcdae7d2c", "comment": "Malware payload (AgentTesla)", "value": "b2d50a2baca82a5a900a0cdc83921ee33ec5f558", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689748942, "uuid": "7a7dd9a8-fbc9-4728-b6f8-254c78aeaebc", "comment": "Malware payload (AgentTesla)", "value": "263e5280a022f72e631429f568b049a8235cb585ba2340069a196ea04046a840edad735dc239b967b73efe5b8655e646", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748942, "uuid": "2052effa-58b7-4e7f-9e9c-c4c1d85113e6", "value": "T148D4229092FD8A33C5E427F467A0FB6246B0DFC92429EA9A9FD3FDD6B04374001456A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748942, "uuid": "63c8811f-5c34-465f-9e8a-31fdc56b28a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748942, "uuid": "b7890bfa-9783-4862-a435-ba4bfb0fac2d", "value": "12288:0PYPfY7NWu5uZY6rmFpXUhNUSKpOILx6Peo:0PYPgwuKYtwUfO0x6Pe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689748942, "uuid": "384ff4bf-21cc-4e29-b94c-d40bc54a20df", "value": 634880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689748942, "uuid": "d9ce437d-94b4-49f8-a4a7-8945b28e8c78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689748942, "uuid": "4d9ee0c1-40a8-4f2b-b02a-ecb86112cb21", "value": "a95f9a75b4460b7983279a879c9ec0f9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61ad1adb-2610-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689756229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689756229, "uuid": "95c71d0d-79f1-462d-8130-9f76307f0b4f", "comment": "Malware payload (AgentTesla)", "value": "a0f971a8f55645d2de3aa12e4a04fee8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689756229, "uuid": "af5124e9-528a-45a7-852d-fe8bba6d3a1b", "comment": "Malware payload (AgentTesla)", "value": "f5c1e959753342533cbd0ca3dea69f4a7212070a314b75db381add8a0f75623f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689756229, "uuid": "b4abf25a-b0ba-456e-bb00-130f28b89c88", "comment": "Malware payload (AgentTesla)", "value": "0570bb0cd06ed5fb53a8de1b35d1848209284dbd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689756229, "uuid": "abf79de5-6fee-4a97-83e7-80af4f1e7f5f", "comment": "Malware payload (AgentTesla)", "value": "fa886310a0f283d0bd4f5ba2daf3cb380573120e804fdb2372113f5f5b3522df6035ccc3e358d99a88e5523a4539bfda", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689756229, "uuid": "9b122bb0-f363-4900-b53d-8227bc3381bc", "value": "T18A5423255A9FA73E05D66A95D4305C8E83E6C1ACA3731FF2B858AEE0D694111B3E03DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689756229, "uuid": "452bae27-05d6-402f-b11b-a67791b61567", "value": "6144:wK/k+K+/pTxfJ0KMyKio5UTDRzFJ9XXpBz1prQg1JEz+344xUxBHRBP5J:y+K+/pTx6KMyho5sRzFJZpB1a9un+z7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689756229, "uuid": "c57c4842-b0e4-49ed-b2f9-cab785a38764", "value": 280588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689756229, "uuid": "624b9723-86da-4fe5-828d-81ef6334afe1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689756229, "uuid": "bb556fc3-bb5e-4a76-aaa1-c31995829007", "value": "Quotation 911799 - EM092722.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73066edb-262a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689767425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689767425, "uuid": "22f99556-08d2-4d0e-a290-d26cbf260e49", "comment": "Malware payload (RedLineStealer)", "value": "d34cfe3583bc421f5644a1fd7ed61f53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689767425, "uuid": "846ae229-cf29-4e56-b841-40da340a1d94", "comment": "Malware payload (RedLineStealer)", "value": "f6dc0b4c65662a9753e54800489b07d9f5a6a4c896a61d93f3a1a3e28d5bc9d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689767425, "uuid": "1121e9f2-c6d0-46cd-bdb6-44868d0bf259", "comment": "Malware payload (RedLineStealer)", "value": "75ccaf032237a6b8a392fa4ab52577030f805e1c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689767425, "uuid": "0d6e26fa-ba70-4fa6-a775-6c9ec123c077", "comment": "Malware payload (RedLineStealer)", "value": "e648683b6d54d17dcb2e69b304d8d46d79fd3d2fbc3ef66db4ab48de7688e457db7b26159110753460cb0eb17eb24f1f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689767425, "uuid": "e60d43d3-8f8a-4dbb-9404-06c6d12f86b0", "value": "T1C8840212B7E84073EDB51B740DFB13830A35BCB19DB483AB2396594A1CB2684E47677B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689767425, "uuid": "d9eeed1c-28c9-4a3e-a5cb-820a8b789748", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689767425, "uuid": "07844558-20ca-4760-a3be-432ab101f27f", "value": "6144:KAy+bnr+ip0yN90QEOZrg/uOH+aqFJOhbEM7bSnjHwVCcHnlRHVVE/iRzFmp:kMrCy908ZrgWBa25njHhcHnl9Yqmp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689767425, "uuid": "0ed5d239-e162-4bf5-a3bb-b35c8b87a21f", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689767425, "uuid": "6c95cd08-12f1-47a3-803d-e5cbf7d5523d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689767425, "uuid": "54586cf9-b4f6-499e-aeec-dfa5d3e3e97d", "value": "d34cfe3583bc421f5644a1fd7ed61f53.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2d921ab-2642-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GCleaner)", "timestamp": 1689777840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689777840, "uuid": "9f6ef7a6-d313-4c01-a6f8-01506963c665", "comment": "Malware payload (GCleaner)", "value": "0184090f4c2e1eb13d5ca645eebabd7d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689777840, "uuid": "27ca9c80-a457-4598-8ddf-a77373340bcf", "comment": "Malware payload (GCleaner)", "value": "f720adb293b902682f3cbbdc944d5530da794ca95ef0f06416f9f07dc0bdb022", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689777840, "uuid": "709bc909-7193-47fb-acd8-611c4859ef6e", "comment": "Malware payload (GCleaner)", "value": "ef4f79e462f44085bd0e6a4057a51db3afdde7d1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689777840, "uuid": "49e5a955-3085-4af8-abab-6310e0880197", "comment": "Malware payload (GCleaner)", "value": "d72d46854bacb18598ed04082d911de40d33b9c2ad24aad40af0086125f63f8feab043f0b707ccb4e8afb5e970f975e9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689777840, "uuid": "da521330-5ed5-4a79-b7b5-ff6c1d3db243", "value": "T1E974E02139D09032D1B72A3048B2D5521A6BFD72AB7057CF37A43A6E6E713D24E74B87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689777840, "uuid": "ffd9b2fa-7ba1-4d30-89dd-72db6c0283d1", "value": "6d688d9cc0f6602b42d54dce0edb5c52", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689777840, "uuid": "729afd0d-da9f-47a5-b2f6-2a1ea4f20cb7", "value": "6144:X6p3kLxP48e2qjL7yLKK+LRijMl5ok4+txwKXwDFA6o:qhkLW4qjfyLtqwjaok4+EKgDFA6o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689777840, "uuid": "bd9f5ee6-8aa7-44c5-ac23-7e60074ed749", "value": 338432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689777840, "uuid": "bbe41e25-3bd9-4238-ba09-361252a60206", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689777840, "uuid": "abd7ee74-555e-46b1-b137-b8907fb32703", "value": "0184090f4c2e1eb13d5ca645eebabd7d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c89aa9a-2627-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Hydra)", "timestamp": 1689766126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689766126, "uuid": "2950b151-3e0c-4629-ab8b-9b8ad51d085b", "comment": "Malware payload (Hydra)", "value": "02e5ce5a8c2aa4eb998cedfe6ceb0e4d", "object_relation": "md5", "Tag": [ { "name": "android_hydra", "colour": "#626579", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689766126, "uuid": "c913797a-a125-49d8-9714-46a613fbd094", "comment": "Malware payload (Hydra)", "value": "f7262977c5f2f360abb00855781aae57666f46a2900eb99035f506611b78fd2e", "object_relation": "sha256", "Tag": [ { "name": "android_hydra", "colour": "#626579", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689766126, "uuid": "1b4eb3cd-a91e-43d9-9327-17cb2d594db5", "comment": "Malware payload (Hydra)", "value": "2aa386ede68e8de5ccaaba3e042509d31aab3ea3", "object_relation": "sha1", "Tag": [ { "name": "android_hydra", "colour": "#626579", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689766126, "uuid": "1c24cccb-c00a-431c-af5a-a13436d2df54", "comment": "Malware payload (Hydra)", "value": "badbbdfcdb06900d10ea831eaf917600003c0731d364db98e364a64ccd5e48084437bad7ee39feff1b10e995c5fa8882", "object_relation": "sha3-384", "Tag": [ { "name": "android_hydra", "colour": "#626579", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689766126, "uuid": "c90ef9cb-05b7-4be3-be79-29b81b9c3960", "value": "T140163390F6989143FDFA2B745D16C0D283677E09DA66E16F712AB30D26B3DC08F91923", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689766126, "uuid": "75fff2ed-ee30-4c88-bf99-3d63f7cb059a", "value": "98304:7LiK5Uy3vl8Mg+MlX2yEjHME7gKiPgdHf6m68wwQ0sUaxgk0:PiIPqMgxGfLMkiotPfww4xgk0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689766126, "uuid": "40ae7476-42d2-4360-8bda-def494cebd30", "value": 4044383, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689766126, "uuid": "7bb8d05c-8ae8-429d-986f-d29778948561", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689766126, "uuid": "50f6a790-228f-413a-be29-bf748a0207f1", "value": "6-aligned-signed_en.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb57341a-25e4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689737589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689737589, "uuid": "7247a168-af07-42e7-8939-63f70b6d20c4", "comment": "Malware payload (RedLineStealer)", "value": "dc0d6257af6ac44eb10333a282b0f738", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689737589, "uuid": "dac4e1ad-8271-40e6-9d23-fed344e56f03", "comment": "Malware payload (RedLineStealer)", "value": "f80103f2a3b19dc0e0b26e84e4f259b5e07226527c06b253ea441c98eeb98808", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689737589, "uuid": "873487af-d597-47f3-8f73-958f82ae85cc", "comment": "Malware payload (RedLineStealer)", "value": "a749e2c90b313174a91a6e51db6bc8e6dc00f37e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689737589, "uuid": "b49cd124-e1e3-44d1-8cb3-5eef3981c18f", "comment": "Malware payload (RedLineStealer)", "value": "a69439d0ba14d2833546da6fda5a5e7d183965f70adbf8e330784d9bda39e2b86fca76a668df2557a6652a97fe7d8d49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689737589, "uuid": "ef96d110-caf6-4eb7-bd3f-1a9c87fe8200", "value": "T1BBD34B9537D98A29E5FD0B74A5B1002987F0F8236511E79F6FC1B0DF1E31BC0B6126AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689737589, "uuid": "7e737f6f-8c97-4848-9bd5-a8b0f2e28290", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689737589, "uuid": "5ba9e8f9-5fee-418f-aefb-69ef83caeea6", "value": "1536:CaxcnVHT1u/o8kJ6O+fbhKOF8FFD/WD/38VFhmLjf0bV7q/OOPWsYgibfbFDKsR0:HxcZZFqzhKp7OjA/mnMIG8YgafJl0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689737589, "uuid": "8e0fa733-9444-4521-9d5a-abb257704274", "value": 130048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689737589, "uuid": "8487af9d-3b1d-479b-bea4-3bd00c968c11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689737589, "uuid": "4393e339-6609-4813-8345-ab8d551c9728", "value": "_@ytlogsbot.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16d03eb2-266a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689794758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689794758, "uuid": "02ba4050-4d02-4ac2-9bba-d47996107945", "comment": "Malware payload (RedLineStealer)", "value": "bbd803ba42646b999d3c747ba4a12dc5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689794758, "uuid": "282d7543-c0dd-4393-aefa-d71755dca2a6", "comment": "Malware payload (RedLineStealer)", "value": "f8a61e60f4d6dac5f60dbea8a1c19c7a9220dc0dd1260a51f78e7568b8c0f48e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689794758, "uuid": "f187563b-2055-4cb1-9e5c-3270c286ceb6", "comment": "Malware payload (RedLineStealer)", "value": "89e47fe7189fa18ee9876af6acb61ca9003cea9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689794758, "uuid": "5b1b6e3c-48c9-4706-81b9-e5f42fe6d35f", "comment": "Malware payload (RedLineStealer)", "value": "ce0d1d27bba93767bd39ce8c4e95d2e9624102423e5e828d38514dc371db334f94982380b7a2ba75c725c7fc8af27a2c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689794758, "uuid": "1b82e67b-6ef5-4787-8ab1-0c7951348803", "value": "T103840112ABE9C572DA7517B05CF617C31B35BDA19E78832B3249A81E18B39C0A53173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689794758, "uuid": "9f5fc391-7e5c-4530-aa06-2db6c8ec94b5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689794758, "uuid": "73671158-ea82-4930-a947-477ae59eb7d3", "value": "6144:K2y+bnr+Op0yN90QEHy8wbgm2lvM6FHvtEG2DYhzjkMuHzHnR7zrylMVs8MEF:GMriy90py8wkfh6G9Pk/HzH1/ylMAU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689794758, "uuid": "124b6874-e9f0-4e9a-882f-a84240b553d8", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689794758, "uuid": "735abfa8-eef6-424d-a15a-99653ff6ac4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689794758, "uuid": "2ab63964-581c-4746-99af-aef33debef32", "value": "f8a61e60f4d6dac5f60dbea8a1c19c7a9220dc0dd1260.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c41114e-25f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689745563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689745563, "uuid": "b2791ccc-ad00-4dc6-9849-15b407db251a", "comment": "Malware payload (AgentTesla)", "value": "d50fd597a4ccbbdc124f4a1bce25e6f7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689745563, "uuid": "0c3edbf9-91e7-469b-88b9-99949616062f", "comment": "Malware payload (AgentTesla)", "value": "f8fec649697b2837d15ea05d581987b63003ab6f8897a3c00423c2c4431a089b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689745563, "uuid": "8e7ed77e-6516-4acc-9ecc-15dc899f8809", "comment": "Malware payload (AgentTesla)", "value": "e88783535c9836029ca4ba8500b913bffb21fecb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689745563, "uuid": "4c331982-956a-4dbf-97ae-fd9a98b59ee3", "comment": "Malware payload (AgentTesla)", "value": "30a43bf315d0b41dd301b78177194b970a7cc626218f9ed4e4783d40272a6f98a653352f9e33d9c3daf171fe429ecec9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689745563, "uuid": "1ff0a44f-ea1f-4a1c-b6c3-a91addd0ea96", "value": "T198C423B6C8505A719FD2CE471DD0B745716DCE9BA0B4D0EE3142700A76AA893EF31FA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689745563, "uuid": "a4658980-9338-4706-b91d-44071649149f", "value": "12288:ZZaQh/8DnZXTgFsq2Crp4M04+253aQ5I6x1qbvzkmXv:ZAQhU7ZjIsq2CxlDis1qbImXv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689745563, "uuid": "d6ad9984-0feb-486b-b0e2-88da2489b06b", "value": 588869, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689745563, "uuid": "02ea4419-c03f-4d6d-8048-5750164b7632", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689745563, "uuid": "b8446cb6-5880-4a7e-bc2b-fc68fdb93eb9", "value": "DHL Receipt_AWB#27040829822.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f4ad54f-25f8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (a310Logger)", "timestamp": 1689745944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689745944, "uuid": "f176fbec-3a6a-435f-8583-d16d40a67562", "comment": "Malware payload (a310Logger)", "value": "4d742a20a527bb66c333540fd60aff79", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689745944, "uuid": "960f7cd7-0fe7-4b2c-bb84-e0ad954f394b", "comment": "Malware payload (a310Logger)", "value": "f96c71db6d9cd486c3977225347131f4c64322fc95b26f9a5f5cba60a835e95e", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689745944, "uuid": "37abe569-ef2f-429a-949c-29388b20fbe6", "comment": "Malware payload (a310Logger)", "value": "c8e790428af7c6e9ae127a852d6534aa8068ca35", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689745944, "uuid": "99c4a847-a1d2-4a7b-b023-17d003636662", "comment": "Malware payload (a310Logger)", "value": "a2a2de9d1ab6f2e66c692f58eab7d80b651877fdd3022c98233a54b4bdb170d855c8bee1e93c8c21e7a3ab42fc75955c", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689745944, "uuid": "3e6d4e8e-3b97-4bbd-8eff-fda3221cebea", "value": "T15875AA2A38AA110DB361AD9C6FBCB175910EF7F2163A5C774DF7060A25138F0CB9D626", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689745944, "uuid": "b633c4f0-39e6-45ab-8faa-6dbedfed8a2a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689745944, "uuid": "a46e7188-44b8-4f99-a5e0-8f2cda43a153", "value": "12288:3ZwUt5pnAYxJsBDrYPL32PWfDyVan2bAESn97ahY9ceFI/t7tH8rxnaj2/e/PeEE:U8rxnajdM2th9VYB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689745944, "uuid": "38c65cd2-2e87-434b-bb15-500324a6f072", "value": 1675264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689745944, "uuid": "8f59384f-aa23-4ae1-9bd9-3903966f556a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689745944, "uuid": "3606e3c0-4b18-4bc5-b63c-73f8ec7781eb", "value": "NNNb887.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efa0f560-2665-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689792974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689792974, "uuid": "fc8b7f54-1e74-4fc5-8f28-c78f28d8a149", "comment": "Malware payload (Amadey)", "value": "d058d7e1ff40bcb69b2502982b54c6d1", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689792974, "uuid": "7d7262bf-9541-43d3-9d97-99bc8ca995cb", "comment": "Malware payload (Amadey)", "value": "f99b01fe273c10a10b96c6f88bdebe4a8bddaf6aedd6574c916d244afcc3fca9", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689792974, "uuid": "41d0ad6a-5e56-418d-9d27-d874a1ce57c5", "comment": "Malware payload (Amadey)", "value": "3c5f198c6678744498191f3a42b16a23456a237f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689792974, "uuid": "8c726f98-afa3-4b40-968e-0475fec3a49a", "comment": "Malware payload (Amadey)", "value": "4dcbff7ae6e20e09d3419bd9ee75c280b9f13fde3bce686011e9ce0a07954dad92bfa96f072b56e9191c18d471124274", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689792974, "uuid": "e76767ec-9a8c-4ab5-8078-bad1bc660408", "value": "T1C7B41203AAE98133E9F52B7058FA16D30E397C939E78936B1385549F0DB3680953673B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689792974, "uuid": "b93a391e-cb09-4e5a-8a12-9d95fcf90b8a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689792974, "uuid": "326463d1-5622-4dc5-8912-c5d8bb605cdb", "value": "6144:Khy+bnr+tp0yN90QEewcEp2i5zx3rRE/pYzYVt/clx2oiwnYysIdir5bzbxFV964:bMrdy90eEpl5vhYv/clxr5dirtdM61L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689792974, "uuid": "ef834704-8834-4359-a104-e02e23a41758", "value": 526848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689792974, "uuid": "30a298f5-7b76-4344-8490-a37312224b2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689792974, "uuid": "9bf1d6e5-5fb2-4075-b1e9-f56fd458ae93", "value": "d058d7e1ff40bcb69b2502982b54c6d1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "428c31d1-2671-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689797838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689797838, "uuid": "9f4fbd88-2086-409d-a0d2-e47e02501a48", "comment": "Malware payload (Mirai)", "value": "c661c3be5e29c3a71b854602686e39c7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689797838, "uuid": "257bb956-5e22-4b06-8f70-22f851d7231e", "comment": "Malware payload (Mirai)", "value": "fa20eb6d49674e55d6eb8404b682c24521e1ec5fddd04922c35d95debd1a2e01", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689797838, "uuid": "fdaf38d6-d058-4a8d-8a73-3faed3cae53a", "comment": "Malware payload (Mirai)", "value": "922d5b37ee4faf3c7ed4b47cc65d6cda797fe6f3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689797838, "uuid": "6db83e99-32a2-41cd-b95b-e4308cc59de0", "comment": "Malware payload (Mirai)", "value": "e7cbef04d7a8286279990c3c3231a523f13634f158f1c6a29174be1d25b9589f11dbe03ae9fe5a731dcee7d0d66e4ec1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689797838, "uuid": "3278fe94-64cf-48f3-a0eb-7434556fe07d", "value": "T1BAD2E1ADDA68378CE4665B32446FC12F7496ECA3932F82C647C84912283894D677EEC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689797838, "uuid": "707e4e75-0e49-4829-802a-3ff9f6e95412", "value": "384:MmGclfUDwDsOAFImUQSAAHCw9TKcSLJY7eoayfsqxRFpDU7/2LLvlZNyqk:YcmROmIIAi8KpLJY7Pa6tpI7/gQd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689797838, "uuid": "c610a303-cae2-44d8-b162-9cf0ae4a6bc9", "value": 30008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689797838, "uuid": "f825e74f-0d41-4872-8cf3-cd10e52e12bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689797838, "uuid": "3f7e94bb-a53a-48c5-8081-588031190548", "value": "c661c3be5e29c3a71b854602686e39c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e81d2d89-2637-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689773205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689773205, "uuid": "00765881-9334-4262-bb36-505d55595962", "comment": "Malware payload (AgentTesla)", "value": "0bcb54c360edfe2011c5ff9013d97c44", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689773205, "uuid": "d7048955-e5cc-41ab-8dfc-7f627f3abaa5", "comment": "Malware payload (AgentTesla)", "value": "fa94a5c024e6156dd957cf797e393b8ccaf125491763cb97a8fdaaa9c8803940", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689773205, "uuid": "a2de2266-5e25-4710-8501-9dc16c985ad9", "comment": "Malware payload (AgentTesla)", "value": "2d78dc803eedc9058ddd8898565fde2699de75fb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689773205, "uuid": "a2d470c5-293d-4394-b11d-a6dfba87bcc9", "comment": "Malware payload (AgentTesla)", "value": "e598617ca72d308f5051dd0a207d248b667fed715efb29a11147902e5894a77bd130855451c048bc0d48334c665972c6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689773205, "uuid": "fe045591-4440-4a25-a38b-c5473658a8d9", "value": "T1BEF4C0E47340D0AEC8578579C9369EA3B523A55E8E1D820E2883BF4F7D2E34785174EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689773205, "uuid": "44edcccc-ea7f-471c-b56b-e18e46085a60", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689773205, "uuid": "8a1e02ba-1ae5-4c59-ae34-de93ce850b17", "value": "12288:2S998yfb/WT4UkuZb5ogoO2+8zonZAh+KU4IoDm0VW0jPFbHnYPt0dAA:t9RfzW/Zb5oXdV2pgbjnVA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689773205, "uuid": "d1f9e615-a54c-4f73-8f0f-142d3b2163d4", "value": 756736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689773205, "uuid": "b8fa021e-5d12-4c05-9fb6-96c48eb3718a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689773205, "uuid": "f1916c6f-226e-4207-846a-7a25277eb7d7", "value": "documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a8d15ab-2618-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1689759573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689759573, "uuid": "93ddee2d-bfd6-4d59-ab50-e205218933fe", "comment": "Malware payload (Loki)", "value": "a30f255d2d8f3b25d33d4f670843e901", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689759573, "uuid": "ed7644e0-7a9e-4b6d-9759-b37c41b9ddd2", "comment": "Malware payload (Loki)", "value": "faf6943211190f86e38fad307c55717e2502871e459a7b2ebbab03a577601885", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689759573, "uuid": "80fffff4-365e-4fe6-8650-80bcb9ad1b4b", "comment": "Malware payload (Loki)", "value": "5bf558a9388604e7a2efc619d52f8219596322d2", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689759573, "uuid": "35e04036-5539-48ac-92a6-3fcf8e7149db", "comment": "Malware payload (Loki)", "value": "9cb02df44bf9bc431d5df298794d2afdebc6e3c682fa525c188b5878f61b0f605fe943a38dca38c1611f89463731d6b7", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689759573, "uuid": "617a61b8-8bc6-4a8e-b37d-d1f4bb26d927", "value": "T15CB423EC877C7627657E4C3414E0EAB626829A54BC4DC3C64EBE8F14D7CC03D5A2526E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689759573, "uuid": "c37f192c-cbb6-431c-87bb-8be30e6a57f1", "value": "12288:ScU2gxvS2P3i3ua/Hjd+775PtoNAOnKM0YrA5Cv8vn8:ScUXZS2PGboHfoNADYVvg8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689759573, "uuid": "cbf4c96e-3f18-47ff-b66a-2c3d1344898b", "value": 519553, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689759573, "uuid": "f38e2d04-22e2-4a7e-902a-441f2bf74791", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689759573, "uuid": "83b30211-8519-44f3-ad18-29a78c87db04", "value": "PI-EP 05919.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9f5af72-262b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1689767974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689767974, "uuid": "51758a77-c15d-4257-b137-188343614657", "comment": "Malware payload (Formbook)", "value": "05cb3b3b1f0aea5ea1db293d68384165", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689767974, "uuid": "3c43b2ac-d4e6-4f2c-9c52-c669142d9c41", "comment": "Malware payload (Formbook)", "value": "fba331672fff828156620f2174204ce1e69f0609d5bc6e18991a1834afbacac9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689767974, "uuid": "f1021830-588c-494a-9339-73f8f70aa978", "comment": "Malware payload (Formbook)", "value": "a1d4b2e20fc7c5c83c701a0bff2a881fa967a7e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689767974, "uuid": "1007d265-2aac-478a-9578-920c5ba172e7", "comment": "Malware payload (Formbook)", "value": "d18ee9001dd036de09cbffea7b03577a992fb6471092ff32a6239fb5c70ecdc114d4a8e2490daee493a920c9c295234d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689767974, "uuid": "77051403-cf6f-4dd7-bcee-a49b4b0fc892", "value": "T1EC5412552AD8E827DC914935593E3B8E4FBAE418043DF91F63E06F5D363A3838A19732", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689767974, "uuid": "cbeade55-22f5-4e5a-a5d6-7d581ce0be9d", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689767974, "uuid": "62719808-ec45-4111-9518-0d7d9c3c2471", "value": "6144:PYa6V/3r2bCBFWr6MIIjTQDsrgqjjl1XUBwDhourNQpc:PYXHGcGRjjLkUhce", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689767974, "uuid": "8d1944c0-2592-4fe8-8b9b-375b8c0c5aea", "value": 279747, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689767974, "uuid": "444fed13-488c-4017-b822-fea729951eff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689767974, "uuid": "305a7816-528f-4a69-8ba0-896983bb16f4", "value": "Swift Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff997b3a-25e5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Phonk)", "timestamp": 1689738026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689738026, "uuid": "9c43e996-49d5-4fae-8882-410b8f8f22f0", "comment": "Malware payload (Phonk)", "value": "b0cb207a394bc5a5a6a987a56ec7d5ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "Phonk", "colour": "#69F639", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689738026, "uuid": "6d4decad-07b5-40fa-b764-cd634b1b58d3", "comment": "Malware payload (Phonk)", "value": "fc29f52e495390630ccda0c1071af6a811eeae68ae7d7cee5de58bdc02f00b61", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "Phonk", "colour": "#69F639", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689738026, "uuid": "3ca16923-ee6f-41f4-90a3-252d1b926735", "comment": "Malware payload (Phonk)", "value": "02937cec5f8f82427b033d31225aa746dd9750c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "Phonk", "colour": "#69F639", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689738026, "uuid": "8172f2c4-2fdb-42ee-b00f-e9fb4c531806", "comment": "Malware payload (Phonk)", "value": "e70526efd8a4e931e343901bae18412f230f3acb2bfe92d80c9e3f487980c1bb367be735643538238e07ffe2224f8788", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false }, { "name": "Phonk", "colour": "#69F639", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689738026, "uuid": "18ef06d4-ff87-4276-b417-a26fe965d1aa", "value": "T171E5C0557A0A8C26DD7D23F1C033060C6BA0DA83270ADD9E36D267DAE74E6E3594D2C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689738026, "uuid": "0c2a726b-914b-492a-8080-fc2ecb593dad", "value": "49152:vLk//TBWXW0BIJ9GyRiwbMws9DnxsqXG02M1KY7Z4sXRuk:vLU/uWUIjGyVMwiLCaZVYk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689738026, "uuid": "a4af9e2f-050a-49e6-8fbe-925a9625d3a7", "value": 3277952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689738026, "uuid": "dd94dcd1-38df-40cd-8ec9-4cb6e67f0986", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689738026, "uuid": "9ddfda3a-7c16-425b-8ce2-241d852ab856", "value": "PCELK.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c060626e-265d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689789459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689789459, "uuid": "fa7c7736-43ae-450f-b737-3bc43457c838", "comment": "Malware payload (Mirai)", "value": "439f66627a4ebb5065602279fc8289a8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689789459, "uuid": "ea885262-d18f-4977-bfb1-9c42d9c5117b", "comment": "Malware payload (Mirai)", "value": "fc920e13cde022f2878417a99e3d391a86f2cff8badd9e7e89b2dc48bc7ea101", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689789459, "uuid": "949311e1-da45-4dde-9e8c-b0228e92a51e", "comment": "Malware payload (Mirai)", "value": "4a3d8f433ca13035a22984eea9ec91e44535b6c5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689789459, "uuid": "16523a93-b582-42b1-b445-55d8399f2e36", "comment": "Malware payload (Mirai)", "value": "90f971b502b84453f4ee65f3178c8b3a17e0f9012c372fc0d16be78768e7eb3db6cb8c299eda251f547e4a5cdb23ac49", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689789459, "uuid": "37156247-1cf2-48ec-8e62-66c3ea4ca6cd", "value": "T14463960A3E218FBEFBAC863847B74A219658339626F1C5C5E15CEE015E7034E745FB98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689789459, "uuid": "251d192d-18ca-41a3-b9dc-72ae8e723b64", "value": "1536:j9NLNxDu9H/hpVBi6yI4W0vK0pErAnGzUNPKkifU:xNL/Dw7j14W0CEELINPKkCU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689789459, "uuid": "9d34232a-5994-4771-9930-cacf4ec1e8b5", "value": 69416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689789459, "uuid": "6c065dbc-c71b-437c-af65-e725f0d1fb51", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689789459, "uuid": "714813ed-935b-49a7-8d6b-c6c9b8acdea2", "value": "ensmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ccdb8c0-2659-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689787547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787547, "uuid": "beca618a-ea13-49d4-b789-3e335018978f", "comment": "Malware payload (Amadey)", "value": "3d46c2ab328dd4b68aef72de59692224", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787547, "uuid": "82504ed3-eb55-4d2b-9005-5fff701b12e9", "comment": "Malware payload (Amadey)", "value": "fd20420ea182a0f5f60f7cc89018f18ce62eb8e96c247e8bbf182edbd087e7f0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787547, "uuid": "06690151-2905-4177-9de6-95985d2faa79", "comment": "Malware payload (Amadey)", "value": "96e2d9b860c353fe7fc3b8d171724202c7aed310", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689787547, "uuid": "c8cdefe6-ab59-4d66-ba04-c6581af78ea7", "comment": "Malware payload (Amadey)", "value": "94b4f1395c0201c349b996fbc6206e7811bd1c407af36a81600e6c7603b08349b700c9913a2ad3294b7ec4914c1c24f0", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787547, "uuid": "bd045a78-09ad-4c2d-a644-ca848de37c4e", "value": "T1E0B40202EBD88436E8F927705CF702831E363CA26D79962B3795981E0CB35D8A535B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787547, "uuid": "ed2e08a8-d4f7-4df3-9cb5-658f3ce80bf5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787547, "uuid": "298956aa-1b57-479f-bb7a-c47b27ad3ab3", "value": "12288:3Mrjy90TZsJMFI+t3xgc7ORAR55ghvAJfN:4yH+Bx/7ORARf1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689787547, "uuid": "7ea8ec8a-b6ca-4cf3-9c7f-6df22383ebd7", "value": 527360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689787547, "uuid": "55b22539-2229-479a-829a-3ed716a9587b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689787547, "uuid": "aea9d6cd-fd2f-48d8-8ac7-136eb144df17", "value": "3d46c2ab328dd4b68aef72de59692224.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "876395a1-2638-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689773472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689773472, "uuid": "dbbd1670-6231-474f-b3b4-95ab276e29a9", "comment": "Malware payload", "value": "888e24e7152e8345e3056e0af6bcd7ec", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689773472, "uuid": "0483edc4-b05c-496e-93da-77863cfce8a7", "comment": "Malware payload", "value": "fd50c8419d66260b5b89e2086e54a320f37ad89f58f7692794a8a95af219dd75", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689773472, "uuid": "98170bf5-214c-405f-b7f1-11e6a9552863", "comment": "Malware payload", "value": "73ea7893bb9aa0599afdc221772c3b0eb5c18c9a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689773472, "uuid": "cfb113f2-bf73-472e-b369-734a273d4f09", "comment": "Malware payload", "value": "bba923adefce1af2f4146170e659c7a3daf084b2a95dcdd3e8915a33e8ae5981bcc269397a1e222034a5ebddbc4f2244", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689773472, "uuid": "338e135d-d343-469b-b0ec-f146daaf457c", "value": "T1A6338E0576E0C0B3D9A7063519AD9722467FBC629AF4C0933FAE060D5EB15C1BA3D3A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689773472, "uuid": "242d9cb8-3f5e-4639-ad8d-dd24693caef6", "value": "b3c5e81c2a49c8b00d13a96c67599538", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689773472, "uuid": "8b4e6998-b0ab-4cef-8ff2-3a5884979ac1", "value": "768:heFetUkXrgsqkjF78W5ZbYEhEFpJU+WFNKojistyxdjWTtVQ98lA9OY8MR1gh:heFef7BwWQhD7WTtej1g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689773472, "uuid": "dcf7a0cc-455f-4c9a-9a4d-837fac3bc94d", "value": 54784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689773472, "uuid": "0884512e-5a22-4831-a3cf-a7f117f23f5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689773472, "uuid": "97a16e73-9ccf-4cd2-a072-ef9f320f50c9", "value": "SecuriteInfo.com.Win32.PWSX-gen.7534.15260", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1f6f6d9-2637-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1689773168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689773168, "uuid": "8474ce4e-0b2c-4e13-82a1-92614dd75de5", "comment": "Malware payload (AgentTesla)", "value": "d8129bf1f1731a8d7c2e4c951df120da", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689773168, "uuid": "1025eadc-afa1-437d-a670-e6fe4a6488fc", "comment": "Malware payload (AgentTesla)", "value": "fd80a61471b89fd67b5c966308c329fde1c6e70b0c229ac77d3407ca612090da", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689773168, "uuid": "d41e69a4-48a5-44e1-aa15-32a7f2d1b05d", "comment": "Malware payload (AgentTesla)", "value": "35bc216b4b5c27f8b499cf985e56df5400d1252a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689773168, "uuid": "51514ed7-2fc3-40a6-9bbb-b021f42c2109", "comment": "Malware payload (AgentTesla)", "value": "a050c6ba98b95b9ea385d5bf2ab64646c995d44db11b5e58b78ac3168c6a1407e7c9361339e23a1f059f19c16e405551", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689773168, "uuid": "8dba07fb-b56d-4d61-b7da-a139cad85c96", "value": "T179E4E0403B6EDE64CB99437A461383E863380D09B64DDD2836C6768C11FF6D2E653ADB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689773168, "uuid": "c8c2ce3c-1aba-4ea9-a4d7-f5a21d0fcdfb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689773168, "uuid": "96c32f40-754a-48b6-bbb2-999bb2796712", "value": "12288:qf7mKpal5XpclyG2C2sFZh+HHp0j/sqi+BvIs5:qDc5XpoV3rgu/os", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689773168, "uuid": "0877e44a-f164-49fb-a3ba-8d8c04525cc1", "value": 660480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689773168, "uuid": "d1ccbe7c-70f4-4515-88ef-15fdecc12ce8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689773168, "uuid": "73ea8eb4-7034-4a68-8fbe-5a3e1d0ab504", "value": "Scanned_CORRECTION-AMENDMENTS EFFECTED_SHIPMENT DOCUMENTS Tuticorin MV GRACE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50c484a3-2652-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1689784547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689784547, "uuid": "f7a4f9ad-5f2b-4b7f-a6d6-5fbf234718e9", "comment": "Malware payload (Formbook)", "value": "b115afe0e3b6cfcfd998ef6e75f0cf10", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689784547, "uuid": "ccbfdc2a-aa6c-4bfd-a14b-f40804407f74", "comment": "Malware payload (Formbook)", "value": "fda6905b52e31be00c704e3e972f070e1be6d10156b3a450cc5c5cdde3539776", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689784547, "uuid": "744b8adb-c00d-44a5-960d-5b02906573e0", "comment": "Malware payload (Formbook)", "value": "10e03fbd6789cd287443e4fd9c38e2bdfa93837b", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689784547, "uuid": "039a1cc9-5fdf-4ab2-b605-3e27a6288e16", "comment": "Malware payload (Formbook)", "value": "f489de74b5a2c42426a392aab7be3d5511b0d01fddbac294f02af071c25fd9a883f337f9e9bbce316cdbae34b8bd4e78", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689784547, "uuid": "397b2c8b-ba0d-4f24-a7b8-b83f84e0a97e", "value": "T1DE55AFF876047DE6666F576BDA96ACDC03B617239A8BA4CC80647BC305A3375FE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689784547, "uuid": "4688cf8c-e975-4347-b980-64d448682d89", "value": "24576:94MmRa/g5pO5xKFE68mKgOMkoSEiDByq/g94ZGDPK+G+qoBHSlMKiMsbEpY1GB+2:F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689784547, "uuid": "b95bffc0-370b-4c68-bc0c-820d0f4b5e87", "value": 1374123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689784547, "uuid": "c0bb9380-97ca-4800-b53c-afdd50fdd9a9", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689784547, "uuid": "94f212a6-dacf-453f-918c-895f3b3d7423", "value": "PO74847 Kirtinvest001.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "849d7759-2628-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689766596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689766596, "uuid": "6e0840bf-8c59-4a0c-a412-bb8c4a738aee", "comment": "Malware payload", "value": "c18be9990d123202d3a6f04d2565c9fc", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689766596, "uuid": "6a5ccdec-03b2-4d75-8d40-a4c6e55284e5", "comment": "Malware payload", "value": "fe587e83e84faaaf71bce643c77b077a3c8162bb63973cc43831a0f9f4c7dbe9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689766596, "uuid": "e013847e-23e7-45d2-9871-340e65a50ffd", "comment": "Malware payload", "value": "15ffd3ff9f0d3b96e78d87cd2a8141f060c67902", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689766596, "uuid": "39a89243-2ba9-46ca-8798-89cdd62c5fb9", "comment": "Malware payload", "value": "8ba418a9bb301dd759eb567c64dfcb4ebc71b777382efb813ac69382b7dda39c675f333ef45fac9ccdf3b88645f82d6c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FruitMiX", "colour": "#232AF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689766596, "uuid": "b8274c4d-42e0-4caa-93be-d5c8608544ed", "value": "T1BB5512F243E88245E1BE63BA1A2CD2585F7CBC0256A0D20A45D648DDD9F47C2EC9973F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689766596, "uuid": "1902fbe1-b812-460a-8511-dc3f4463b9f4", "value": "576cf7a5c7ccedb67a1aaa13f458d177", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689766596, "uuid": "d5d3b3b0-764e-4fa2-8e29-42d6f14cf223", "value": "24576:+gpSttGlLfpm/myRvpDRs0EY/J7NJtP7lK+/aeksSr9:Z5LyR177pKYaevc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689766596, "uuid": "675e62ed-d0d8-4b0c-af21-dd0844a8152d", "value": 1359872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689766596, "uuid": "6d8fdbfb-d7be-4a25-9abb-4fef7f5591f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689766596, "uuid": "3e8e036f-da10-4a51-a332-56028620263a", "value": "LjtdWS~o.cpl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3493a088-25fb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689747134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747134, "uuid": "d88310c4-b90e-4d1b-912d-ea0ad683adf6", "comment": "Malware payload (Mirai)", "value": "3768bbe8501f3becb5f4d9f768fc566c", "object_relation": "md5", "Tag": [ { "name": "2-59-255-213", "colour": "#A4F8B9", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747134, "uuid": "6bff9fb1-297b-4fc9-aaf3-8504b958a0c1", "comment": "Malware payload (Mirai)", "value": "fe68ed8ba958f3967364857edbe45f3923624848d32b844579d4155a486f49d8", "object_relation": "sha256", "Tag": [ { "name": "2-59-255-213", "colour": "#A4F8B9", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747134, "uuid": "d63bedae-6094-4045-bdd5-91900c4a657a", "comment": "Malware payload (Mirai)", "value": "7132a2f2f8d14e468e89d4254e01cee8b4b54a04", "object_relation": "sha1", "Tag": [ { "name": "2-59-255-213", "colour": "#A4F8B9", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689747134, "uuid": "c6a8562a-d711-4f37-ac9d-6069b9e0a4b1", "comment": "Malware payload (Mirai)", "value": "e0fd43e046b04a6779653ca11b4823c93116b6797dd4bc653a15539a592ebcc62d2312a856416521b80fbb93f546c16a", "object_relation": "sha3-384", "Tag": [ { "name": "2-59-255-213", "colour": "#A4F8B9", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747134, "uuid": "717a0797-39fb-44dd-a1a5-7d5ec5555f59", "value": "T15AD2F225E19EE1D3DA2E29B3FD2F50F660704ABC5224A2047146588ADA3E0D40B37ECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747134, "uuid": "489a06af-2f95-46d5-bfc3-418b6bf73ed1", "value": "768:76f+EtgVlhkN1tApk5v33WQKAt46WSA0xE9+e2TEjx:7QtgXhkNLYk13xKx6JD0+ett", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689747134, "uuid": "ab6d0636-97c8-427e-98e6-497db1cadaae", "value": 29788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689747134, "uuid": "308ec5e0-f69d-4206-b409-7792d262562f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689747134, "uuid": "5c5ce057-be8b-4dc3-9645-89743b324741", "value": "sora.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f597d97e-261f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1689762920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689762920, "uuid": "3c2d7e81-1a49-4542-8699-c2dee8ba9a95", "comment": "Malware payload (Amadey)", "value": "771e446ca7a0fee961f985d5f3534b42", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689762920, "uuid": "ceaa574c-e7bc-4ce3-80d1-0cf724e45bc3", "comment": "Malware payload (Amadey)", "value": "ff7353080f239a2fa969fd38c9b3006514f717122165492b8cb5e1bd573b0c5b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689762920, "uuid": "e5e4cf5a-d03a-4235-a625-d81276e27773", "comment": "Malware payload (Amadey)", "value": "16549eedba4ac0a0ef8fe8545fc2bb434a79d495", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689762920, "uuid": "174b5f8a-cd38-4785-82ad-15d1b2bdf24c", "comment": "Malware payload (Amadey)", "value": "8bdd9b80f2e6270ee5d625c2be54236593914900dbcb79421741c7f4e225af4f5a0e639b88c24febdaa150f64fec6a6a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689762920, "uuid": "3fc0af42-0bbc-43fd-80d4-8a79a16dd818", "value": "T174B41212A3E84433DDB527706CF713D30B363DA08E6886A72786AC4E1D735D8A57672B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689762920, "uuid": "c49ec7f7-2546-4253-ab2f-134e41d9756b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689762920, "uuid": "5c8b80f4-deac-4c44-8bf5-ab04b9551871", "value": "12288:8Mr5y90MS5vt+OaHc2H4nEFB0mnUFUf54bLYdRFyq:Nygn2Nim8VY7L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689762920, "uuid": "dc7990c2-8806-40b1-a497-f8ff1c521680", "value": 527360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689762920, "uuid": "7993a467-0a4f-40f4-a0da-3b035b2ecc3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689762920, "uuid": "e1f44ad6-f262-4945-b60a-af91376bd098", "value": "771e446ca7a0fee961f985d5f3534b42.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }